Systems Auditor Examination flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Detection risk

The risk that audit procedures fail to detect a material error or control weakness that exists. The auditor reduces it by increasing sample sizes, using more reliable evidence, or performing substantive tests.

Attribute sampling

A statistical sampling method that estimates the rate at which a control deviation occurs in a population. It supports compliance testing conclusions, not the estimation of monetary misstatement amounts.

Audit finding structure

A finding states the condition observed, the criteria it violates, the cause, the effect or risk, and a recommendation. The recommendation is the auditor's proposed corrective action for management to accept or reject.

Materiality

The threshold above which an omission or misstatement could influence decisions of report users. It is set during planning and determines the nature, timing, and extent of audit procedures.

Audit evidence reliability hierarchy

Evidence obtained directly by the auditor is most reliable, followed by external evidence, internal evidence, and oral representations. Documentary evidence generally outweighs verbal assertions from management.

Walk-through

Tracing one or a few transactions through the entire process to confirm the auditor's understanding of the control flow. It validates design understanding, not operating effectiveness over a period.

IT governance definition

The board and executive responsibility for setting IT direction, aligning IT with enterprise strategy, monitoring performance, and ensuring risks are managed. It is distinct from day-to-day IT management.

COSO five components

Control environment, risk assessment, control activities, information and communication, and monitoring activities. These components underpin the 17 principles used to assess internal control over financial reporting.

COBIT domains

EDM is the governance domain (evaluate, direct, monitor). APO, BAI, DSS, and MEA are management domains covering align-plan-organize, build-acquire-implement, deliver-service-support, and monitor-evaluate-assess.

Segregation of duties

Dividing incompatible duties so no single person can initiate, authorize, record, and reconcile a transaction. Custody of assets is separated from recordkeeping and from authorization to prevent concealment of errors or fraud.

Three lines model

Operational management owns and manages risk as the first line. A risk and compliance function monitors as the second line. Internal audit provides independent assurance as the third line.

Key risk indicator

A metric that signals increasing exposure to a risk before loss occurs, such as rising failed login attempts or aging change tickets. It differs from a KPI, which measures goal achievement.

Policy versus standard versus procedure

A policy states mandatory management intent. A standard specifies mandatory technical requirements. A procedure gives step-by-step instructions. Guidelines are recommended but optional practices.

IT steering committee role

A governance body of business and IT leaders that prioritizes IT investments, allocates resources, resolves cross-functional conflicts, and monitors project and service performance against agreed objectives.

User acceptance testing

Testing performed by business users with realistic data to confirm the system meets documented requirements and is fit for purpose. It precedes final sign-off and production cutover.

Separation of development and production

Developers should not have write access to production. An independent party migrates approved code using change tickets, preventing unauthorized or untested code from reaching live systems.

Change management controls

Documented request, impact and risk assessment, authorized approval, testing evidence, backout plan, and post-implementation verification. Emergency changes require retrospective review after the fact.

Parallel conversion

Running the legacy and new systems simultaneously for a period and reconciling outputs. It reduces cutover risk but is costly, so pilot or phased conversion is often preferred.

Post-implementation review

A structured assessment after go-live confirming that promised benefits were realized, costs were controlled, and lessons were captured. Its absence is a project governance weakness.

Data conversion reconciliation

Comparing record counts, control totals, and opening balances between legacy and new systems and obtaining business sign-off. It addresses completeness and accuracy risks during migration.

Regression testing

Retesting existing functionality after a change to confirm nothing previously working has broken. It is essential for changes to shared code, interfaces, or database structures.

Recovery time objective

The maximum acceptable time to restore a service after disruption. It drives the choice of recovery site and is set by the business, not by IT alone.

Recovery point objective

The maximum tolerable data loss expressed in time, determined by backup or replication frequency. An RPO of one hour means backups or replication must occur at least hourly.

Backup rotation generations

Grandfather-father-son rotation keeps daily, weekly, and monthly copies offsite. Restoring requires the latest full backup plus all subsequent incremental or differential sets in the chain.

Hot, warm, and cold sites

A hot site is fully equipped for immediate takeover, a warm site is partially equipped, and a cold site provides only space and power. Cost and recovery time trade off against each other.

Maximum tolerable downtime

The longest time a business process can be unavailable before unacceptable impact occurs. The MTD constrains the RTO, which must be shorter than the MTD.

Job scheduling exception reporting

Automated alerts when scheduled jobs fail or overrun, plus review of console logs. Without it, failed jobs silently corrupt downstream data and reports.

Business continuity versus disaster recovery

Business continuity planning addresses processes, people, and facilities. Disaster recovery planning addresses technology and data restoration. Both require periodic testing with documented results.

Role-based access control

Permissions are assigned to roles rather than individuals, and users are placed in roles. It supports least privilege and simplifies provisioning, review, and termination of access.

Digital signature properties

A signature created with the sender's private key provides integrity, sender authentication, and non-repudiation. It does not provide confidentiality, which requires encryption of the content.

Symmetric versus asymmetric encryption

Symmetric algorithms such as AES are fast and used for bulk data but need secure key distribution. Asymmetric algorithms such as RSA and ECC ease key exchange and enable signatures.

Certificate revocation checking

Validating that a certificate has not been revoked before its expiry, using a certificate revocation list or the online certificate status protocol. It complements chain validation to a trusted root.