CISA ISACA (Cht. 1) Questions & 100% Correct Answers

Audit Charter :~~ An overarching document that covers the entire scope of the audit activities in an entity. (Purpose, responsibility, authority, and accountability). An engagement letter is more focused on a particular audit exercise that is sought to be initiated in an organization with a specific objective in mind. When does audit planning occur? What factors should be taken into account in the analysis? :~~ Short and long term analysis should occur annually to take into account new control issues; changes in risk environment, technologies and business processes; and enhance evaluation techniques. Who reviews and who approved audit activities? :~~ The audit activities should be reviewed by senior audit management and approved by the audit committee or BOD. Audit assignment considerations for the approach :~~ -periodic risk assessment -changes in application of tech 2 | P a g e | © copyright 2024/2025 | Grade A+ Master01 | September, 2024/2025 | Latest update -evolving regulatory requirements -implementation/upgrade deadlines -current and future technologies -requirements from the business -resource limitations Steps to perform Audit Planning :~~ -gain understanding of biz mission, objectives, purpose and processes (I.e. availability, integrity, security and business technology and information confidentiality) -understand changes in biz environment -review work papers -identity stated contents (policies, standards, procedures, org structure) -perform risk analysis to design audit plan -set audit scope and objectives -develop audit approach or strategy -assign resources -address logistics Steps performed to determine org's level of compliance with external requirements 3 | P a g e | © copyright 2024/2025 | Grade A+ Master01 | September, 2024/2025 | Latest update :~~ -identify those gov or external requirements around - electronic data, personal data, copyrights, e-commerce, e-signitures - computer system practices and controls - computer, program, and data storage - org/activities of info tech services - IS audits -document applicable laws/regulations -assess if org/IT function considered external req in policies, procedures, and standards -review docs that address adherence to laws -determine if proce