ETiCPA ATQE Exam flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

COBIT governance domains

COBIT divides governance into Evaluate, Direct, and Monitor (EDM), while management covers APO, BAI, DSS, and MEA. Governance sets direction and monitors; management plans, builds, runs, and measures.

Residual risk

The risk remaining after controls have been applied. It is compared to risk appetite to decide whether further treatment is required, and it is the level reported to management.

Three lines model

First line owns and manages risk operationally; second line provides oversight, frameworks, and challenge; third line is internal audit, providing independent assurance to the governing body.

Material weakness

A deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

ITGC categories

The four IT general control areas are access to programs and data, program changes, program development, and computer operations. They underpin reliance on automated application controls.

Automated control reliance

Reliance on an automated control requires effective IT general controls over change and access for the relevant system. If ITGCs fail, the auditor tests the control directly or performs substantive procedures.

Performance materiality

An amount set below overall materiality to reduce to an appropriately low level the probability that uncorrected and undetected misstatements exceed materiality. Commonly 50 to 75 percent of materiality.

Walkthrough purpose

A walkthrough traces one transaction through the process to confirm the auditor's understanding and verify the control is designed and implemented as described. It is not a test of operating effectiveness.

Audit risk model

Audit risk equals inherent risk multiplied by control risk multiplied by detection risk. Detection risk is controlled by the auditor through the nature, timing, and extent of procedures.

Attribute sampling

A statistical sampling method used to test controls, measuring the deviation rate in a population against a tolerable rate at a specified confidence level.

Sampling risk

The risk that the auditor's conclusion based on a sample differs from the conclusion reached by testing the entire population. It is quantified in statistical sampling.

Evidence reliability

Evidence is more reliable when obtained from independent external sources, from the auditor's direct observation, from original documents, and when controls over its generation are effective.

Recovery time objective

The maximum acceptable time to restore a process or system after disruption. It drives recovery architecture decisions and is validated through disaster recovery testing.

Recovery point objective

The maximum acceptable amount of data loss, expressed in time. It determines backup frequency and replication design, and is validated during restore testing.

Known error

A problem that has a documented root cause and a workaround. Known error records support faster incident resolution and feed permanent fix planning.

Privileged access management

Controls over administrative accounts including separate admin identities, just-in-time elevation, session logging, and periodic review of administrative group membership.

Vulnerability prioritization

Ranking vulnerabilities using severity scores plus exploitability, asset criticality, and exposure. Remediation deadlines are set by severity tier and verified before closure.

Multi-factor authentication

Authentication requiring at least two different factor types: something you know, something you have, or something you are. Two instances of the same factor type do not constitute MFA.

Change segregation of duties

The roles that develop, test, and deploy code should be separated. Developers should not have write access to production, which prevents unauthorized code changes reaching live systems.

Emergency change control

A change implemented under expedited approval using pre-defined criteria, followed by retrospective review and documentation of the emergency justification within a defined window.

User acceptance testing

Business-owner testing of a system against requirements before go-live. Evidence includes test cases, results, logged defects, and formal sign-off by the accountable business owner.

Data minimization

A privacy principle requiring that only personal data necessary for the stated purpose is collected and retained. It reduces breach impact and supports storage limitation obligations.

Privacy impact assessment

A structured assessment performed before high-risk processing begins, identifying privacy risks and mitigations. Triggers include large-scale sensitive data, systematic monitoring, and new technology.

Cloud shared responsibility

The provider secures the cloud infrastructure, while the customer secures data, identities, access configuration, and workloads. Control testing must reflect which party owns each control.

Finding elements

A complete audit finding states criteria (what should be), condition (what is), cause (why it happened), effect or risk, and a recommendation with management response.

Follow-up closure criteria

A finding is closed only when evidence shows the remediated control operated as intended after the agreed date. Management assertion alone is insufficient for closure.

Repeat finding

A finding that recurs from a prior audit, indicating remediation failed or was not sustained. It is reported with the original reference and escalated to the audit committee.

Root cause analysis

A technique such as the five whys or fishbone diagram used to identify the underlying reason a control failed, so recommendations address cause rather than symptom.

Control self-assessment

A process where process owners assess their own controls. Results inform risk assessment and scoping but do not replace independent auditor testing of control effectiveness.

Business impact analysis

An analysis identifying critical business processes, their dependencies, and the impact of disruption over time. Outputs set recovery time and recovery point objectives for continuity planning.

Monetary unit sampling

A sampling method where each monetary unit in a population has an equal chance of selection. It is used mainly for substantive testing of overstatement and focuses on larger items.

Data classification

Assigning data to tiers such as public, internal, confidential, and restricted. Classification determines handling rules, encryption requirements, access controls, and retention periods.