CISA Practice Questions - 1 Study
The purpose of a checksum on an amount field in an electronic data interchange communication of
financial transactions is to ensure - integrity
can be used to identify unauthorized modifications. - A checksum
Which of the following is an attribute of the control self-assessment approach? - Broad stakeholder
involvement
The control self-assessment (CSA) approach - emphasizes management of and accountability for
developing and monitoring the controls of an organization's business processes.
The attributes of CSA include - empowered employees, continuous improvement, extensive employee
participation and training—all of which are representations of broad stakeholder involvement.
They play a key role in minimizing exposure to unauthorized transactions. - electronic data interchange
(EDI) transactions
An IS auditor who has discovered unauthorized transactions during a review of electronic data
interchange (EDI) transactions is likely to recommend improving the - authentication techniques for
sending and receiving messages.
During the planning stage of an IS audit, the PRIMARY goal of an IS auditor is to - address audit
objectives.
ISACA IS Audit and Assurance Standards require that an IS auditor plan the audit work to address - the
audit objectives. The activities described in the other options are all undertaken to address audit
objectives and, thus, are secondary.
During an exit interview, in cases where there is disagreement regarding the impact of a finding, an IS
auditor should - elaborate on the significance of the finding and the risk of not correcting it.
If the auditee disagrees with the impact of a finding, it is important for an IS auditor - to elaborate and
clarify the risk and exposures because the auditee may not fully appreciate the magnitude of the
exposure. The goal should be to enlighten the auditee or uncover new information of which an IS
auditor may not have been aware.
Anything that appears to threaten the auditee lessens effective communications and sets up an
adversarial relationship, but an IS auditor should not - automatically agree just because the auditee
expresses an alternate point of view.
Which of the following represents the GREATEST potential risk in an electronic data interchange (EDI)
environment? - Lack of transaction authorizations
lack of transaction authorization is the greatest risk with EDI - Because the interaction between parties is
electronic, there is no inherent authentication occurring
, A long-term IT employee with a strong technical background and broad managerial experience has
applied for a vacant position in the IS audit department. Determining whether to hire this individual for
this position should be PRIMARILY based on the individual's experience and - ability, as an IS auditor, to
be independent of existing IT relationships.
Independence should be continually assessed by the auditor and management. This assessment should
consider such factors as - changes in personal relationships, financial interests, and prior job
assignments and responsibilities.
A substantive test to verify that tape library inventory records are accurate is - conducting a physical
count of the tape inventory.
A substantive test includes gathering evidence to - evaluate the integrity (i.e., the completeness,
accuracy and validity) of individual transactions, data or other information. Conducting a physical count
of the tape inventory is a substantive test.
In the process of evaluating program change controls, an IS auditor would use source code comparison
software to - examine source program changes without information from IS personnel.
When an IS auditor uses a source code comparison to examine source program changes without
information from IS personnel, the IS auditor has an - objective, independent and relatively complete
assurance of program changes, because the source code comparison identifies the changes.
Which audit technique provides the BEST evidence of the segregation of duties in an IT department? -
Observation and interviews
Based on the observations and interviews, the IS auditor can evaluate the - segregation of duties. By
observing the IT staff performing their tasks, an IS auditor can identify whether they are performing any
incompatible operations. By interviewing the IT staff, the auditor can get an overview of the tasks
performed.
Which of the following forms of evidence would an IS auditor consider the MOST reliable? - The results
of a test performed by an external IS auditor
An independent test that is performed by an IS auditor should always be - considered a more reliable
source of evidence than a confirmation letter from a third party, because the letter is the result of an
analysis of the process and may not be based on authoritative audit techniques. An audit should consist
of a combination of inspection, observation and inquiry by an IS auditor as determined by risk. This
provides a standard methodology and reasonable assurance that the controls and test results are
accurate.
An IS auditor conducting a review of disaster recovery planning (DRP) at a financial processing
organization discovered the following:
-The existing DRP was compiled two years earlier by a systems analyst in the organization's IT
department using transaction flow projections from the operations department.
The purpose of a checksum on an amount field in an electronic data interchange communication of
financial transactions is to ensure - integrity
can be used to identify unauthorized modifications. - A checksum
Which of the following is an attribute of the control self-assessment approach? - Broad stakeholder
involvement
The control self-assessment (CSA) approach - emphasizes management of and accountability for
developing and monitoring the controls of an organization's business processes.
The attributes of CSA include - empowered employees, continuous improvement, extensive employee
participation and training—all of which are representations of broad stakeholder involvement.
They play a key role in minimizing exposure to unauthorized transactions. - electronic data interchange
(EDI) transactions
An IS auditor who has discovered unauthorized transactions during a review of electronic data
interchange (EDI) transactions is likely to recommend improving the - authentication techniques for
sending and receiving messages.
During the planning stage of an IS audit, the PRIMARY goal of an IS auditor is to - address audit
objectives.
ISACA IS Audit and Assurance Standards require that an IS auditor plan the audit work to address - the
audit objectives. The activities described in the other options are all undertaken to address audit
objectives and, thus, are secondary.
During an exit interview, in cases where there is disagreement regarding the impact of a finding, an IS
auditor should - elaborate on the significance of the finding and the risk of not correcting it.
If the auditee disagrees with the impact of a finding, it is important for an IS auditor - to elaborate and
clarify the risk and exposures because the auditee may not fully appreciate the magnitude of the
exposure. The goal should be to enlighten the auditee or uncover new information of which an IS
auditor may not have been aware.
Anything that appears to threaten the auditee lessens effective communications and sets up an
adversarial relationship, but an IS auditor should not - automatically agree just because the auditee
expresses an alternate point of view.
Which of the following represents the GREATEST potential risk in an electronic data interchange (EDI)
environment? - Lack of transaction authorizations
lack of transaction authorization is the greatest risk with EDI - Because the interaction between parties is
electronic, there is no inherent authentication occurring
, A long-term IT employee with a strong technical background and broad managerial experience has
applied for a vacant position in the IS audit department. Determining whether to hire this individual for
this position should be PRIMARILY based on the individual's experience and - ability, as an IS auditor, to
be independent of existing IT relationships.
Independence should be continually assessed by the auditor and management. This assessment should
consider such factors as - changes in personal relationships, financial interests, and prior job
assignments and responsibilities.
A substantive test to verify that tape library inventory records are accurate is - conducting a physical
count of the tape inventory.
A substantive test includes gathering evidence to - evaluate the integrity (i.e., the completeness,
accuracy and validity) of individual transactions, data or other information. Conducting a physical count
of the tape inventory is a substantive test.
In the process of evaluating program change controls, an IS auditor would use source code comparison
software to - examine source program changes without information from IS personnel.
When an IS auditor uses a source code comparison to examine source program changes without
information from IS personnel, the IS auditor has an - objective, independent and relatively complete
assurance of program changes, because the source code comparison identifies the changes.
Which audit technique provides the BEST evidence of the segregation of duties in an IT department? -
Observation and interviews
Based on the observations and interviews, the IS auditor can evaluate the - segregation of duties. By
observing the IT staff performing their tasks, an IS auditor can identify whether they are performing any
incompatible operations. By interviewing the IT staff, the auditor can get an overview of the tasks
performed.
Which of the following forms of evidence would an IS auditor consider the MOST reliable? - The results
of a test performed by an external IS auditor
An independent test that is performed by an IS auditor should always be - considered a more reliable
source of evidence than a confirmation letter from a third party, because the letter is the result of an
analysis of the process and may not be based on authoritative audit techniques. An audit should consist
of a combination of inspection, observation and inquiry by an IS auditor as determined by risk. This
provides a standard methodology and reasonable assurance that the controls and test results are
accurate.
An IS auditor conducting a review of disaster recovery planning (DRP) at a financial processing
organization discovered the following:
-The existing DRP was compiled two years earlier by a systems analyst in the organization's IT
department using transaction flow projections from the operations department.
