Audit Reporting and Quality CISA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An IS auditor is writing the final report for an audit of a company's data backup process. The audit found that backups are performed daily, but restoration tests are not conducted regularly. The auditor wants to ensure the report clearly communicates the risk. Which section of the report should emphasize the potential impact of not testing restorations?

   • AThe methodology section, by explaining how the audit was conducted.
   • BThe appendix, by providing raw data on backup frequency and restoration test results.
   • CThe executive summary, by stating that the company may be unable to recover data in a disaster.
   • DThe audit scope section, by listing the backup systems that were tested.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a key step in the process of tracking and verifying remediation of audit findings?

   • ARepeating the full audit to ensure all findings are resolved
   • BPerforming follow-up procedures to confirm that corrective actions have been implemented
   • CClosing all findings immediately after the audit report is issued
   • DRelying solely on management's verbal assurance that actions are complete
   Reveal Solution Discussion Select an answer first
4. 28expert · hard · select all that apply

   The internal audit department wants to improve the efficiency of its audit process. The CAE is considering several metrics to monitor. Select all that apply. Which metrics are directly related to audit process efficiency?

   • AAverage number of audit days per audit
   • BPercentage of audits completed within the planned budget
   • CPercentage of audit budget spent on external services
   • DNumber of audit findings per audit
   • ETime from audit fieldwork completion to report issuance
   Check answers Discussion Select an answer first
5. 29application · medium

   The internal audit department of a large corporation is establishing a Quality Assurance and Improvement Program (QAIP) for the first time. The chief audit executive (CAE) wants to ensure the program includes both internal and external assessments. Which combination of activities best fulfills this requirement?

   • AOnly conduct an external assessment every three years because external reviews are more objective.
   • BPerform a self-assessment once and then rely on management feedback for continuous improvement.
   • CConduct an annual self-assessment and an external peer review every five years.
   • DImplement a system to track audit hours and budget, and consider that a QAIP.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   After completing several audits, the internal audit team notices that the same type of finding keeps recurring in different departments. The CAE wants to improve the audit methodology to address this pattern. Which action is most aligned with continuous improvement of audit practices?

   • ADocument the recurring finding in the next audit report without further analysis.
   • BIncrease the number of audits performed to catch more instances of the finding.
   • CBenchmark the audit process against other departments within the organization only.
   • DConduct a lessons-learned session to analyze why the finding recurs and update the audit program to include more targeted testing.
   Reveal Solution Discussion Select an answer first