CISA Chapter 1 exam prep 2026
An audit charter should be approved by: - correct answersHigher Management
The audit charter should: - correct answersIncorporate the scope, authority, and responsibility of the
audit department.
The prime objective of an audit charter is to: - correct answersDocument the responsibility and
authority of the audit department
The document that delegates the authority to the audit department is: - correct answersThe audit
charter
The prime reason for a review of the organization chart is to: - correct answersUnderstand the authority
and responsibility of the individuals
An IS auditor would be primarily influenced by: - correct answersThe charter of the audit department
Which of the following is a result of the risk management process? - correct answersDecisions regarding
the security policy
On the basis of the outcome of the risk management process, the organization determines the security
requirements. Other choices are not directly impacted by the results of the risk management process.
Which of the following should be included in an audit charter? - correct answersThe audit function's
reporting structure
The overall scope, authority, and responsibility of the audit department is outlined in the audit charter.
It should also document the reporting matrix of the audit function. Generally, the head of the audit
reports to an audit committee.
The scope, authority, and responsibility of the IS audit function is defined by: - correct answersThe
approved audit charter
Which of the following functions is governed by the audit charter? - correct answersThe internal audit
function
Which of the following covers the overall authority to perform an IS audit? - correct answersThe
approved audit charter
The audit function should be reported to the audit committee of the board because: - correct
answersThe audit function must be independent of the business function and should have direct access
to the audit committee of the board
The best objective for the creation of an audit charter is to: - correct answersProvide the authority and
responsibility of the audit function.
, The charter's main purpose is to define the auditor's roles and responsibilities. The audit charter
empowers the audit function to carry out their work. The other options are not relevant to this purpose.
Which of the following is the first step in risk-based audit planning? - correct answersTo identify high-
risk processes in the company
Which of the following is a major advantage of a risk-based approach to audit planning? - correct
answersOptimum use of audit resources for high-risk processes
Which of the following should be the first exercise while reviewing data center security? - correct
answersThe evaluation of vulnerabilities and threats to the data center location.
Getting information and an understanding of the processes being audited and evaluating the risks and
various threats will help auditors to concentrate on high-risk areas, thereby making the audit more
effective and relevant.
Which of the following is the most important aspect of planning an audit? - correct answersIdentifying
high-risk processes
Which of the following is the area of greatest concern in an EDI (Electronic Data Interchange) process? -
correct answersThe contract for the trading partner is not entered.
Legal liability cannot be enforced in the absence of an agreement between trading partners. There may
be uncertainty with respect to legal liability. This will be the area of most concern. A dedicated
communication channel is considered a good control for EDI transactions.
Encryption helps in achieving which of the following objectives in an EDI environment? - correct
answersEnsuring the integrity and confidentiality of transactions
In an EDI environment, which of the following procedures ensures the completeness of an inbound
transaction? - correct answersBuilding a segment count total into transactions set trailer.
Building a segment count total ensures the completeness of inbound transactions in an EDI
environment.
In which of the following processes are details entered by one employee re-entered by another
employee to check their accuracy? - correct answersKey Verification
In key verification, the same field is filled in twice and a machine compares the entries for verification
and validation. A reasonableness check ensures the logical reasoning of an input transaction. The control
total is a system-based control that ensures that all relevant data is captured. A sequence check ensures
the continuity of serial numbers. Completeness controls ensure the presence input for all required
fields.
Which of the following is used in an e-commerce application to ensure that a transaction is enforceable?
- correct answersNon-repudiation
An audit charter should be approved by: - correct answersHigher Management
The audit charter should: - correct answersIncorporate the scope, authority, and responsibility of the
audit department.
The prime objective of an audit charter is to: - correct answersDocument the responsibility and
authority of the audit department
The document that delegates the authority to the audit department is: - correct answersThe audit
charter
The prime reason for a review of the organization chart is to: - correct answersUnderstand the authority
and responsibility of the individuals
An IS auditor would be primarily influenced by: - correct answersThe charter of the audit department
Which of the following is a result of the risk management process? - correct answersDecisions regarding
the security policy
On the basis of the outcome of the risk management process, the organization determines the security
requirements. Other choices are not directly impacted by the results of the risk management process.
Which of the following should be included in an audit charter? - correct answersThe audit function's
reporting structure
The overall scope, authority, and responsibility of the audit department is outlined in the audit charter.
It should also document the reporting matrix of the audit function. Generally, the head of the audit
reports to an audit committee.
The scope, authority, and responsibility of the IS audit function is defined by: - correct answersThe
approved audit charter
Which of the following functions is governed by the audit charter? - correct answersThe internal audit
function
Which of the following covers the overall authority to perform an IS audit? - correct answersThe
approved audit charter
The audit function should be reported to the audit committee of the board because: - correct
answersThe audit function must be independent of the business function and should have direct access
to the audit committee of the board
The best objective for the creation of an audit charter is to: - correct answersProvide the authority and
responsibility of the audit function.
, The charter's main purpose is to define the auditor's roles and responsibilities. The audit charter
empowers the audit function to carry out their work. The other options are not relevant to this purpose.
Which of the following is the first step in risk-based audit planning? - correct answersTo identify high-
risk processes in the company
Which of the following is a major advantage of a risk-based approach to audit planning? - correct
answersOptimum use of audit resources for high-risk processes
Which of the following should be the first exercise while reviewing data center security? - correct
answersThe evaluation of vulnerabilities and threats to the data center location.
Getting information and an understanding of the processes being audited and evaluating the risks and
various threats will help auditors to concentrate on high-risk areas, thereby making the audit more
effective and relevant.
Which of the following is the most important aspect of planning an audit? - correct answersIdentifying
high-risk processes
Which of the following is the area of greatest concern in an EDI (Electronic Data Interchange) process? -
correct answersThe contract for the trading partner is not entered.
Legal liability cannot be enforced in the absence of an agreement between trading partners. There may
be uncertainty with respect to legal liability. This will be the area of most concern. A dedicated
communication channel is considered a good control for EDI transactions.
Encryption helps in achieving which of the following objectives in an EDI environment? - correct
answersEnsuring the integrity and confidentiality of transactions
In an EDI environment, which of the following procedures ensures the completeness of an inbound
transaction? - correct answersBuilding a segment count total into transactions set trailer.
Building a segment count total ensures the completeness of inbound transactions in an EDI
environment.
In which of the following processes are details entered by one employee re-entered by another
employee to check their accuracy? - correct answersKey Verification
In key verification, the same field is filled in twice and a machine compares the entries for verification
and validation. A reasonableness check ensures the logical reasoning of an input transaction. The control
total is a system-based control that ensures that all relevant data is captured. A sequence check ensures
the continuity of serial numbers. Completeness controls ensure the presence input for all required
fields.
Which of the following is used in an e-commerce application to ensure that a transaction is enforceable?
- correct answersNon-repudiation
