CISA
5 Tasks within the domain covering the process of auditing information systems - ANS-1.
Develop and implement a risk-based IT audit strategy in compliance with IT audit standards to
ensure that key areas are included
2. Plan specific audits to determine whether information systems are protected, controlled and
provided value to the organization
3. Conduct audits in accordance with IT audit standards to achieve planned audit objectives
4. Report audit findings and make recommendations to key stakeholders to communicate
results and effect change when necessary
5. Conduct follow ups or prepare status reports to ensure that appropriate actions have been
taken by management in a timely manner
10 Knowledge Statements within the domain covering the process of auditing information
systems - ANS-Knowledge of...
1. ISACA IT Audit and Assurance standards, guidelines, and tools and techniques; code of
professional ethics; and other applicable standards
2. risk assessment concepts, tools and techniques in an audit context
3. control objects and controls related to information systems
4. audit planning and audit project management techniques, including follow up
5. fundamental business processes (purchasing, payrolls, accounts payable, accounts
receivable) including relevant IT
6. applicable laws and regulations that affect the sopce, evidence collection and preservation,
and frequency of audits
7. evidence collection techniques (observation, inquiry, inspectation)
8. different sampling methodologies
9. reporting and communication techniques (faciliatation, negotiation, conflict resolution,)
10. Audit quality assurance systems and frameworks
Knowledge Statement 1: Knowledge of the ISACA IT audit and assurance standards,
guidelines, and tools and techniques; Code of professional ethics; and other applicable
standards... what are the key concepts and explanation - ANS-Key Concepts: Code of
Professional ethics and IS audit and assurance standards, guidelines, and tools and techniques
explanation: these standards and rules are issued to provide a framework of minimum and
essential references regarding how an IS audit should perform work and act in a professional
manner
Knowledge Statement 2: Knowledge of risk assessment concepts, tools and techniques in an
audit context.. what are the key concepts and explanation - ANS-Key Concepts: impact of risks
assessment on IS auditing, understanding risks analysis concepts within an auditing context,
applying risk analysis techniques during audit planning
,explanation: overall, the audit plan should be based on business risks related to the use of IT
and the IS audit should be aware of the need to focus on this risk. The auditing should be able
to put into the practice the risk techniques needed to identify and prioritize business risks within
audit scope. The IS auditor must takes steps to minimize associated elements such as sampling
risk, detection risks, materially of findings
Knowledge Statement 3: Knowledge of control objectives and controls related to Information
systems.. what are the key concepts and explanation - ANS-Key concepts: proper auditing
planning techniques, understanding control objectives
Explanation: understanding control objectives and identifying the key controls that help achieve
a properly controlled environment are essential for the effectiveness and efficiency of the IS
audit process.
Knowledge Statement 4: Knowledge of audit planning and audit project management
techinques, including follow up.. what are the key concepts and explanation - ANS-Key
concepts: application of audit planning techniques, and impact of IS environment on IS auditing
practices and techniques
explanation: audit planning request a similar level of preplanning to ensure an appropriate and
efficient use of audit resources.. auditors need to understand the planning and management
techniques to properly management the audit and avoid an inefficient utilization of resources
Knowledge Statement 5: Knowledge of Fundamental business processes (purchasing, payroll,
accounts payable, accounts receivable) including relevant IT...what are the key concepts and
explanation - ANS-Key concepts: understanding risk analysis concepts within an auditing
context, understanding control objectives
Explanation: one must understanding the external and internal factors affecting the entity, the
entities selection and application of policies and procedures. One must also obtain an
understanding of some key components such as the entities strategic management, business
model, and corporate governance processes and the kinds of transactions the entity engages in
and with whom it transact.
Knowledge Statement 6: Knowledge of applicable laws and regulations that affect the scope,
evidence collection and preservation, and frequency of audits....what are the key concepts and
explanation - ANS-Key concepts: Factors to consider in collection, protection and chain of
custody of audit evidence in an IS audit, special considerations in audit documentation for
evidence
Explanation: laws and regulations often determine scope, frequency, and types of audits, and
how reporting requirements are affected
,Knowledge Statement 7: Knowledge of evidence collection techniques (observation, inquiry,
inspections) used to gather, protect and preserve audit evidence....what are the key concepts
and explanation - ANS-Key Concepts: Application and relative value of computer - assisted
audit techniques, techniques for obtaining evidence, computer-assisted audit techniques,
factors to consider in collection, protestation and chain of custody of audit evidence in an IS
audit, specialized considerations in audit document for evidence, continues auditing techniques
Explanation: findings must be supported by objective evidence. Care should be taken for any
evidence that is preserved as a hard copy. Retention policies for electronic evidence be
sufficient to preserve evidence that supports the findings. conclusions should be supported by
reliable and relevant evidence. Evidence collected follows a life cycle included collection,
analysis, and preservation and destruction of evidence. Audit evidence should include
information regarding date of creation and original source. continuous auditing measures by an
automated reporting process that enables management to be aware of emerging risks or control
weaknesses without the need for a regular audit
Knowledge Statement 8: Knowledge of different sampling methodologies...what are the key
concepts and explanation - ANS-Key concepts: relative use of compliance and substantive
testing, basic approaches to sampling their relation to testing approaches
Explanation: compliance testing is evidence gathering for the purpose of testing an enterprises
compliance with control procedures, this differences from substantive testing in which evidence
id gathers to evaluate the integrity of individuals transactions, data or other information. There's
a correlation with the level of internal controls and the amount of substantive testing required.
Sampling is preformed when the time and cost of considerations preclude a total verification of
all transactions or events in a predefined population
Knowledge Statement 9: Knowledge of reporting and communication techniques (Facilitation,
negotiation, conflict resolution, audit report structure)....what are the key concepts and
explanation - ANS-Key Concepts: Understanding reporting standards, applying various
communication techniques to the reporting of audit results, applying communication techniques
to facilitation roles in control self - assessments
Explanation: Communication and negation skills are required throughout the audit activity,
successful resolution of audit findings with auditees is essential so that auditees will adopt the
recommendations in the report and initiate prompt corrective action
Knowledge Statement 10: Knowledge of audit quality assurance systems and frameworks..
what are the key concepts and explanations - ANS-Key Concepts: Impact of IS environment on
IS auditing practices and techniqures, points of relevance while using services of other auditors
and experts, audit quality evaluation, advantages and disadvantages of CSA, the role of the
auditor in CSA, relevance of different technologies drives for CSA in the current business
environment, relevance of different approaches in CSA in given context, applying
, communication techniques to facilitation roles in control self-assessments, audit quality
evaluation
Explanation: IS is a branch of IS auditing. Auditing standards are the minimum parameters that
should be taking. CSA (Control Self Assessment) is a process in which an IS audit can act in
the role of facilitator to the business process owners to help them define and assess appropriate
controls. results must be interpreting with a certain level of skepticism because process owners
are not always objective when assessing their own activates
What is the overall authority to perform an IS audit? - ANS-The approved audit charter
What is the approved audit charter? - ANS-The approved audit charter outlines the auditor's
responsibility, authority and accountability, objectives for, and delegation of authority to, the IS
audit function. This document should outline overall authority, scope and responsibilities of the
audit function.
In performing a risk-based audit, what is the risk assessment that is completed initially by the IS
auditor? - ANS-Inherent risk - it exists independently of an audit and can occur because of the
nature of the business. To perform the audit the IS auditor needs to understand the business
process, and by understanding the business process, the IS auditor better understands the
inherent risks.
While developing a risk-based audit program, what would an IS auditor most likely focus on?
a. business processes
b. critical IT application
c. operational controls
d. business strategies - ANS-Business Processes
A risk - based audit approach focuses on the understanding of the nature of the business and
being able to identify and categorize risk. Business risks impact the long-term viability of a
specific business. An IS auditor using a risk-based audit approach must be able to understand
business processes
What types of audit risks assumes an absence of compensating controls in the area being
reviewed?
a. control risk
b. detection risk
c. inherent risk
d. sampling risk - ANS-Inherent Risk.
The risk level or exposure without taking into account the actions that management has taken or
might take in inherent risk.
5 Tasks within the domain covering the process of auditing information systems - ANS-1.
Develop and implement a risk-based IT audit strategy in compliance with IT audit standards to
ensure that key areas are included
2. Plan specific audits to determine whether information systems are protected, controlled and
provided value to the organization
3. Conduct audits in accordance with IT audit standards to achieve planned audit objectives
4. Report audit findings and make recommendations to key stakeholders to communicate
results and effect change when necessary
5. Conduct follow ups or prepare status reports to ensure that appropriate actions have been
taken by management in a timely manner
10 Knowledge Statements within the domain covering the process of auditing information
systems - ANS-Knowledge of...
1. ISACA IT Audit and Assurance standards, guidelines, and tools and techniques; code of
professional ethics; and other applicable standards
2. risk assessment concepts, tools and techniques in an audit context
3. control objects and controls related to information systems
4. audit planning and audit project management techniques, including follow up
5. fundamental business processes (purchasing, payrolls, accounts payable, accounts
receivable) including relevant IT
6. applicable laws and regulations that affect the sopce, evidence collection and preservation,
and frequency of audits
7. evidence collection techniques (observation, inquiry, inspectation)
8. different sampling methodologies
9. reporting and communication techniques (faciliatation, negotiation, conflict resolution,)
10. Audit quality assurance systems and frameworks
Knowledge Statement 1: Knowledge of the ISACA IT audit and assurance standards,
guidelines, and tools and techniques; Code of professional ethics; and other applicable
standards... what are the key concepts and explanation - ANS-Key Concepts: Code of
Professional ethics and IS audit and assurance standards, guidelines, and tools and techniques
explanation: these standards and rules are issued to provide a framework of minimum and
essential references regarding how an IS audit should perform work and act in a professional
manner
Knowledge Statement 2: Knowledge of risk assessment concepts, tools and techniques in an
audit context.. what are the key concepts and explanation - ANS-Key Concepts: impact of risks
assessment on IS auditing, understanding risks analysis concepts within an auditing context,
applying risk analysis techniques during audit planning
,explanation: overall, the audit plan should be based on business risks related to the use of IT
and the IS audit should be aware of the need to focus on this risk. The auditing should be able
to put into the practice the risk techniques needed to identify and prioritize business risks within
audit scope. The IS auditor must takes steps to minimize associated elements such as sampling
risk, detection risks, materially of findings
Knowledge Statement 3: Knowledge of control objectives and controls related to Information
systems.. what are the key concepts and explanation - ANS-Key concepts: proper auditing
planning techniques, understanding control objectives
Explanation: understanding control objectives and identifying the key controls that help achieve
a properly controlled environment are essential for the effectiveness and efficiency of the IS
audit process.
Knowledge Statement 4: Knowledge of audit planning and audit project management
techinques, including follow up.. what are the key concepts and explanation - ANS-Key
concepts: application of audit planning techniques, and impact of IS environment on IS auditing
practices and techniques
explanation: audit planning request a similar level of preplanning to ensure an appropriate and
efficient use of audit resources.. auditors need to understand the planning and management
techniques to properly management the audit and avoid an inefficient utilization of resources
Knowledge Statement 5: Knowledge of Fundamental business processes (purchasing, payroll,
accounts payable, accounts receivable) including relevant IT...what are the key concepts and
explanation - ANS-Key concepts: understanding risk analysis concepts within an auditing
context, understanding control objectives
Explanation: one must understanding the external and internal factors affecting the entity, the
entities selection and application of policies and procedures. One must also obtain an
understanding of some key components such as the entities strategic management, business
model, and corporate governance processes and the kinds of transactions the entity engages in
and with whom it transact.
Knowledge Statement 6: Knowledge of applicable laws and regulations that affect the scope,
evidence collection and preservation, and frequency of audits....what are the key concepts and
explanation - ANS-Key concepts: Factors to consider in collection, protection and chain of
custody of audit evidence in an IS audit, special considerations in audit documentation for
evidence
Explanation: laws and regulations often determine scope, frequency, and types of audits, and
how reporting requirements are affected
,Knowledge Statement 7: Knowledge of evidence collection techniques (observation, inquiry,
inspections) used to gather, protect and preserve audit evidence....what are the key concepts
and explanation - ANS-Key Concepts: Application and relative value of computer - assisted
audit techniques, techniques for obtaining evidence, computer-assisted audit techniques,
factors to consider in collection, protestation and chain of custody of audit evidence in an IS
audit, specialized considerations in audit document for evidence, continues auditing techniques
Explanation: findings must be supported by objective evidence. Care should be taken for any
evidence that is preserved as a hard copy. Retention policies for electronic evidence be
sufficient to preserve evidence that supports the findings. conclusions should be supported by
reliable and relevant evidence. Evidence collected follows a life cycle included collection,
analysis, and preservation and destruction of evidence. Audit evidence should include
information regarding date of creation and original source. continuous auditing measures by an
automated reporting process that enables management to be aware of emerging risks or control
weaknesses without the need for a regular audit
Knowledge Statement 8: Knowledge of different sampling methodologies...what are the key
concepts and explanation - ANS-Key concepts: relative use of compliance and substantive
testing, basic approaches to sampling their relation to testing approaches
Explanation: compliance testing is evidence gathering for the purpose of testing an enterprises
compliance with control procedures, this differences from substantive testing in which evidence
id gathers to evaluate the integrity of individuals transactions, data or other information. There's
a correlation with the level of internal controls and the amount of substantive testing required.
Sampling is preformed when the time and cost of considerations preclude a total verification of
all transactions or events in a predefined population
Knowledge Statement 9: Knowledge of reporting and communication techniques (Facilitation,
negotiation, conflict resolution, audit report structure)....what are the key concepts and
explanation - ANS-Key Concepts: Understanding reporting standards, applying various
communication techniques to the reporting of audit results, applying communication techniques
to facilitation roles in control self - assessments
Explanation: Communication and negation skills are required throughout the audit activity,
successful resolution of audit findings with auditees is essential so that auditees will adopt the
recommendations in the report and initiate prompt corrective action
Knowledge Statement 10: Knowledge of audit quality assurance systems and frameworks..
what are the key concepts and explanations - ANS-Key Concepts: Impact of IS environment on
IS auditing practices and techniqures, points of relevance while using services of other auditors
and experts, audit quality evaluation, advantages and disadvantages of CSA, the role of the
auditor in CSA, relevance of different technologies drives for CSA in the current business
environment, relevance of different approaches in CSA in given context, applying
, communication techniques to facilitation roles in control self-assessments, audit quality
evaluation
Explanation: IS is a branch of IS auditing. Auditing standards are the minimum parameters that
should be taking. CSA (Control Self Assessment) is a process in which an IS audit can act in
the role of facilitator to the business process owners to help them define and assess appropriate
controls. results must be interpreting with a certain level of skepticism because process owners
are not always objective when assessing their own activates
What is the overall authority to perform an IS audit? - ANS-The approved audit charter
What is the approved audit charter? - ANS-The approved audit charter outlines the auditor's
responsibility, authority and accountability, objectives for, and delegation of authority to, the IS
audit function. This document should outline overall authority, scope and responsibilities of the
audit function.
In performing a risk-based audit, what is the risk assessment that is completed initially by the IS
auditor? - ANS-Inherent risk - it exists independently of an audit and can occur because of the
nature of the business. To perform the audit the IS auditor needs to understand the business
process, and by understanding the business process, the IS auditor better understands the
inherent risks.
While developing a risk-based audit program, what would an IS auditor most likely focus on?
a. business processes
b. critical IT application
c. operational controls
d. business strategies - ANS-Business Processes
A risk - based audit approach focuses on the understanding of the nature of the business and
being able to identify and categorize risk. Business risks impact the long-term viability of a
specific business. An IS auditor using a risk-based audit approach must be able to understand
business processes
What types of audit risks assumes an absence of compensating controls in the area being
reviewed?
a. control risk
b. detection risk
c. inherent risk
d. sampling risk - ANS-Inherent Risk.
The risk level or exposure without taking into account the actions that management has taken or
might take in inherent risk.
