ACG 516 Exam 2 | Questions with Verified Answers

ACG 516 Exam 2 | Questions with Verified Answers What is the basic definition of IT audit? examining different IT components and the controls associated with them What are the prerequisites to an organizational audit program? determining what types of audits are needed and identifying what must be or could be audited. Prioritization resources to support audit are scarce, so most significant auditable aspects of organization are addressed. Why is categorization or an organizing scheme required for auditors to audit a large organization? There are too many auditable elements to create a simple list. How does COSO categorize internal control? Purpose and applicability What are examples of categorizing internal controls by purpose? operational, reporting, or compliance What are examples of categorizing internal controls by applicability? entity level, division, operating unit, or function Units of organizational structure business units, operating divisions, facilities, subsidiaries List the accounting structures as defined by Gantz cost centers, lines of business, process areas, strategic goals, objectives and outcomes What are other functional organizational elements? mission and business processes and operational functions executed by the organization What are examples of management functions or programs? governance, risk management, quality assurance, certification, compliance, and internal auditing. What is the primary purpose of governance, risk, and compliance (GRC) activities? Define and prioritize the audit universe What is an "audit universe" Complete collection of all potential areas within an organization that can be audited. What does COBIT stand for and what organization sponsors it? Control Objectives for Information and Related Technology; ISACA How many processes and domains does COBIT 5 encompass? 37 processes; five domains. What did COBIT 5 replace? control objects with recommended governance and management practices and basing audit criteria on seven enablers. What are all the categories in the audit universe? principles policies frameworks processes organizational structures culture ethics behavior information services infrastructure applications people skills competencies List all of the internal control purposes preventive, detective, corrective List all of the internal control functions administrative, technical, physical What controls can be considered entity-wide? any policies, processes, procedures, standards, or measures specified for organization-wide use. Patch Management - IT Audit Focus audit procedures: review procedures for maintaining awareness of patches or upgrades and processes for implementing them, including prerequisite unit and regression testing Account Provisioning - IT Audit Focus audit procedures: review processes and procedures for creating, updating, and removing accounts, and, where applicable, confirm provisioned accounts reflect valid current users. What do system and application mean in the context of an organization? refer to the software and computing capabilities that perform specific functions in support of business processes. What were the systems mentioned in class that organizations use? SAP, Oracle Cloud, QuickBooks, SalesForce Database collection or repository of information maintained by an organization What were the databases mentioned in class? Oracle Autonomous Database, SQL Server, MySQL, MongoDB, Microsoft Access, Teradata What is the primary purpose of developing an audit universe? A. To identify and prioritize potential audit subjects B. To document audit filings C. To train IT auditors D. To comply with legal regulations Which of the following is NOT a type of control commonly audited in IT environments? A. Technical B. Administrative C. Financial D. Physical What framework categorizes internal controls by purpose and applicability? A. COBIT B. ISO/IEC 27002 C. COSO Internal Control - Integrated Framework D. ITIL Which audit procedure is used to verify that unnecessary services are not running on a system? A. Patch management B. Service scanning C. Configuration Analysis D. Logging review What does path analysis in IT auditing examine? A. The lifecycle of a software project B. The flow of information across integrated systems C. The physical layout of a data center D. The organizational structure of IT departments Which IT component is most associated with storing sensitive organizational data? A. Operating systems B. Interfaces C. Hardware D. Databases What distinguishes project audits from system audits? A. Project audits focus on technical configurations B. System audits are only performed during development C. Project audits emphasize management and documentation D. System audits are only performed during development Which SDLC phase involves testing and readiness for deployment? A. Concept B. Development C. Production D. Retirement What is a key audit concern during the retirement phase of a project? A. Performance measurement B. Data sanitization C. Patch management D. User training Which framework provides a cloud-specific control matrix for IT audits? A. COBIT B. COSO C. Cloud Security Alliance D. ISO/IEC 12207 What does SDLC stand for? Software Development Life Cycle