I85PREP
⌘ K
Systems Auditor Examination study materials
Systems Auditor Examination study resources

Systems Auditor Examination practice questions

One question at a time. Build your Systems Auditor Examination understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Systems Auditing Process

An IS auditor is defining the overall scope and objectives of a new audit engagement. Which document should be prepared and approved before fieldwork begins?

  1. The audit engagement letter or charter defining objectives, scope, and responsibilities Correct answer.
  2. The follow-up review plan for prior findings
  3. The final audit report with management responses
  4. The working paper index and cross-reference schedule

Explanation

An engagement letter or audit charter establishes the objectives, scope, authority, and responsibilities of both auditor and auditee, and must be agreed before fieldwork starts. The report, working paper index, and follow-up plan are all outputs or later phases of the audit process.

Question 2Information Systems Auditing Process

During audit planning, an IS auditor assesses inherent risk as high for a payment processing system. What is the most appropriate implication for the audit approach?

  1. Rely solely on management self-assessment questionnaires
  2. Defer the area to the next audit cycle to spread workload
  3. Reduce substantive testing because controls are assumed effective
  4. Increase the extent of testing and assign more experienced staff to the area Correct answer.

Explanation

High inherent risk signals greater likelihood of material error, so the auditor should expand testing and deploy more experienced resources to obtain sufficient assurance. Reducing testing or relying only on self-assessment would lower assurance precisely where risk is greatest.

Question 3Information Systems Auditing Process

Which activity best describes the purpose of an IS audit risk assessment performed at the start of an engagement?

  1. Calculating the residual risk after all controls have been tested
  2. Recording management's acceptance of audit findings
  3. Ranking auditable areas so that scarce audit resources target the highest exposures Correct answer.
  4. Documenting the auditor's independence declaration

Explanation

A planning risk assessment identifies and prioritizes auditable entities or processes by likelihood and impact, allowing resources to focus on the highest exposures. It precedes control testing, so it cannot calculate residual risk after testing.

Question 4Information Systems Auditing Process

An auditor is choosing between statistical and non-statistical sampling for a control test. Which characteristic is unique to statistical sampling?

  1. It requires judgment to select sample items
  2. It allows quantification of sampling risk and projection of results Correct answer.
  3. It reduces the need to document the sampling methodology
  4. It can be applied to both attribute and variable testing

Explanation

Statistical sampling uses probability selection so that sampling risk can be measured and results projected to the population with quantified confidence. Judgment-based selection and applicability to attribute or variable testing are shared with non-statistical approaches.

Question 5Information Systems Auditing Process

An IS auditor finds that a control operates as designed but the underlying control objective does not address a key risk. How should this be classified?

  1. A scope limitation requiring a disclaimer
  2. A control design deficiency Correct answer.
  3. An operating effectiveness failure
  4. A compensating control that mitigates the risk

Explanation

A control that functions correctly but does not address the relevant risk is a design deficiency, because the design itself is inadequate regardless of operation. Operating effectiveness concerns whether a properly designed control works consistently.

Question 6Information Systems Auditing Process

Which evidence is generally the most reliable for an IS auditor to conclude that a system change was properly authorized?

  1. A management representation letter
  2. A verbal confirmation from the change manager
  3. An observation of the change advisory board meeting
  4. A system-generated approval record with user ID and timestamp Correct answer.

Explanation

Evidence generated independently by the system, with identifying details and timestamps, is more reliable than verbal or observational evidence. Observation confirms existence at a point in time but does not prove authorization for a specific change.

Question 7Information Systems Auditing Process

An auditor plans to rely on automated application controls embedded in a system. What is the primary reason to test the general IT controls over program changes?

  1. To measure the performance of the IT help desk
  2. To confirm the application controls continue to operate as intended after changes Correct answer.
  3. To satisfy the requirement for a management representation letter
  4. To verify that the application controls were documented in the audit report

Explanation

Automated controls can be altered or disabled by unauthorized or untested program changes, so effective change management general controls support continued reliance. Documentation and help desk metrics do not provide assurance over control integrity.

Question 8Information Systems Auditing Process

When an IS auditor identifies a potential fraud indicator during an audit, what is the most appropriate first action?

  1. Immediately notify external regulators
  2. Confront the suspected employee directly to obtain a confession
  3. Document the indicator and escalate it through the appropriate governance channel per the audit charter Correct answer.
  4. Disregard it unless it exceeds the materiality threshold

Explanation

Fraud indicators should be documented and escalated to the appropriate level, such as audit management, the audit committee, or those charged with governance, in line with the charter and professional standards. The auditor should not confront suspects or notify regulators unilaterally.

Question 9Information Systems Auditing Process

Which document records the auditor's procedures performed, evidence obtained, and conclusions reached during an engagement?

  1. The management representation letter
  2. The engagement letter
  3. The working papers Correct answer.
  4. The audit charter

Explanation

Working papers are the record of procedures, evidence, and conclusions that support the audit opinion and demonstrate due professional care. The charter and engagement letter define authority and scope, while the representation letter is management's written confirmation.

Question 10Information Systems Auditing Process

An IS auditor is reviewing a sample of access provisioning requests. Which technique provides the strongest evidence that access was granted only to authorized users?

  1. Reading the user awareness training materials
  2. Reviewing the access policy document
  3. Interviewing the security administrator about the process
  4. Comparing approved requests to system access logs for the same users Correct answer.

Explanation

Correlating approved requests with actual system access records provides direct evidence that authorization preceded provisioning. Policy review, interviews, and training materials indicate intent or awareness but not actual execution.

Question 11Information Systems Auditing Process

Which statement best describes the concept of audit materiality in an IS audit?

  1. The maximum sample size the auditor may select
  2. The length of time evidence must be retained
  3. The threshold at which a misstatement or control weakness could influence decisions of report users Correct answer.
  4. The total number of findings the auditor must report

Explanation

Materiality is the threshold above which omissions or misstatements could reasonably influence the decisions of those relying on the audit report. It is a judgment about significance, not a count of findings, sample size, or retention period.

Question 12Information Systems Auditing Process

An auditor discovers that a key control was not operating for two months during the audit period. How should this affect the auditor's conclusion?

  1. The finding should be omitted because it is a temporary lapse
  2. The control can still be relied upon for the full period if it operates now
  3. The control cannot be relied upon for the full period, and the impact on the audit conclusion must be assessed Correct answer.
  4. The auditor should extend the audit period to exclude the lapse

Explanation

A control that failed for part of the period cannot support reliance for the whole period, so the auditor must evaluate the resulting risk and adjust conclusions or testing. Temporary lapses still represent periods of unmitigated exposure.

Question 13Information Systems Auditing Process

Which of the following is the best example of a substantive test in an IS audit?

  1. Observing the segregation of duties in the data center
  2. Reviewing the change management policy
  3. Interviewing the database administrator about backup procedures
  4. Recomputing system-calculated interest amounts for a sample of transactions Correct answer.

Explanation

Substantive testing obtains direct evidence about the completeness, accuracy, or validity of transactions or balances, such as recomputing calculated amounts. Observation, policy review, and interviews are tests of controls or inquiry rather than substantive procedures.

Question 14Information Systems Auditing Process

An auditor wants to confirm that terminated employees no longer have active system accounts. Which procedure best addresses this objective?

  1. Comparing the current system user list to the human resources terminated-employee list Correct answer.
  2. Reviewing the termination policy for approval requirements
  3. Interviewing managers about their termination practices
  4. Reviewing the access control matrix design

Explanation

Matching active system accounts against HR termination records provides direct evidence of whether accounts were removed. Policy review, interviews, and design review do not confirm the actual state of user accounts.

Question 15Information Systems Auditing Process

Which factor most affects the auditor's judgment about the sufficiency of audit evidence?

  1. The quantity and quality of evidence relative to the risk and materiality of the area Correct answer.
  2. The number of prior audits performed in the organization
  3. The physical size of the working paper file
  4. The seniority of the auditee who provided the evidence

Explanation

Sufficiency concerns the quantity of evidence, and appropriateness concerns its quality and relevance, both judged against the risk and materiality of the area under review. Volume of paperwork or the source's seniority alone does not establish sufficiency.

Question 16Information Systems Auditing Process

An IS auditor is preparing the audit report and must decide where to place a significant control weakness. What is the most appropriate treatment?

  1. Report it only verbally to management to preserve relationships
  2. Include it in an appendix so it does not distract from positive findings
  3. Omit it if management promises to remediate quickly
  4. Report it prominently with its risk impact and recommended action Correct answer.

Explanation

Significant weaknesses must be communicated clearly and prominently, along with their risk implications and recommendations, so that governance can act. Burying, omitting, or communicating only verbally undermines the report's purpose.

Question 17Information Systems Auditing Process

During an engagement, the auditee restricts the auditor's access to system logs needed to test a key control. What is the most appropriate auditor response?

  1. Accept the restriction and rely on management's verbal assurance
  2. Expand the audit scope to other areas without noting the restriction
  3. Document the scope limitation and escalate it to audit management and governance Correct answer.
  4. Issue an unqualified conclusion because other evidence exists

Explanation

A restriction on access is a scope limitation that must be documented and escalated, as it may affect the auditor's ability to conclude. Relying on verbal assurance or ignoring the limitation would compromise the audit's integrity.

Question 18Information Systems Auditing Process

Which of the following best describes the purpose of a follow-up audit activity?

  1. To reassess the auditor's independence
  2. To verify that management has implemented agreed remediation for prior findings Correct answer.
  3. To update the audit charter for the coming year
  4. To re-perform the entire original audit from planning

Explanation

Follow-up confirms whether management actions have addressed previously reported findings and reduces the risk that issues remain unresolved. It is targeted at remediation status rather than repeating the full engagement.

Question 19Information Systems Auditing Process

An IS auditor is testing whether a batch job reconciles transaction totals between two systems. Which type of control is being tested?

  1. A preventive access control
  2. A detective reconciliation control Correct answer.
  3. A directive policy control
  4. A corrective backup control

Explanation

Reconciliation compares two sets of records after processing to detect discrepancies, making it a detective control. It does not prevent errors at the point of entry, correct them automatically, or direct behavior through policy.

Question 20Information Systems Auditing Process

When planning audit procedures, an IS auditor considers the concept of audit risk. Which component represents the risk that the auditor's procedures fail to detect a material misstatement?

  1. Control risk
  2. Inherent risk
  3. Detection risk Correct answer.
  4. Business risk

Explanation

Detection risk is the risk that audit procedures will not detect an existing material misstatement, and it is managed by designing appropriate testing. Inherent and control risk relate to the entity's environment and controls, while business risk concerns the organization's operations.

Question 21Information Systems Auditing Process

An auditor uses CAATs to test 100 percent of transactions in a high-volume system. What is the primary benefit of this approach?

  1. It removes sampling risk for the tested population Correct answer.
  2. It guarantees that all fraud will be detected
  3. It eliminates the need to understand the business process
  4. It replaces the need for general IT control testing

Explanation

Testing the entire population with computer-assisted techniques removes sampling risk because no sample is drawn. It does not eliminate the need to understand the process, guarantee fraud detection, or substitute for general IT controls.

Question 22Information Systems Auditing Process

An auditor is evaluating whether a sample result supports reliance on a control. Which consideration is most relevant to concluding on the sample?

  1. The number of years the auditor has worked in the industry
  2. The length of the audit report
  3. The color scheme used in the sampling worksheet
  4. The tolerable deviation rate and the upper deviation rate derived from the sample Correct answer.

Explanation

In attribute sampling, the auditor compares the upper deviation rate, considering sampling risk, with the tolerable deviation rate to decide whether to rely on the control. Presentation details, experience, and report length do not drive the statistical conclusion.

Question 23Information Systems Auditing Process

Which situation most likely indicates a need for the auditor to revise the audit program during fieldwork?

  1. The auditee provides requested evidence on schedule
  2. Testing reveals that a key control operates differently than documented Correct answer.
  3. The working paper file is properly cross-referenced
  4. The audit team completes interviews as planned

Explanation

When evidence shows that actual operations differ from the documented design, the auditor must reassess risk and adjust procedures to obtain sufficient evidence. On-schedule evidence and completed planned steps do not in themselves require program changes.

Question 24Information Systems Auditing Process

An IS auditor is assessing the reliability of evidence obtained from a system-generated report. Which factor most increases its reliability?

  1. The report was generated directly from the source system with controls over its parameters Correct answer.
  2. The report was summarized in a presentation
  3. The report was prepared by the auditee's IT manager
  4. The report was reviewed by the internal audit team after generation

Explanation

Evidence produced directly by the source system, with controlled parameters, is more reliable than manually prepared or summarized information. A preparer's seniority or later review does not substitute for system-generated integrity.

Question 25Information Systems Auditing Process

Which action best demonstrates due professional care by an IS auditor during an engagement?

  1. Skipping documentation when findings are obvious
  2. Relying on the auditee to define the audit scope
  3. Applying the standards and methodology appropriate to the engagement and documenting judgments Correct answer.
  4. Accepting all management explanations without corroboration

Explanation

Due professional care means applying relevant standards and methodology, exercising sound judgment, and documenting the basis for conclusions. Letting the auditee set scope, skipping documentation, or accepting explanations uncorroborated falls short of this duty.

Question 26Information Systems Auditing Process

An IS audit team is defining the overall scope and objectives of an upcoming engagement for a newly acquired subsidiary. Which document should establish the authority, responsibility, and high-level approach before fieldwork begins?

  1. The prior year's management response tracker
  2. The IT general controls matrix maintained by the subsidiary
  3. The detailed audit program listing each test step
  4. The engagement audit charter or engagement letter approved by the audit committee Correct answer.

Explanation

The engagement charter or letter formally authorizes the audit, defines its objectives and scope, and establishes the auditor's responsibilities and access rights. Detailed test steps come later in the audit program, and prior responses or control matrices are inputs, not the authorizing document.

Question 27Information Systems Auditing Process

An IS auditor is deciding how much reliance to place on the IT control environment of a payment processor. Which combination best supports a decision to increase planned reliance?

  1. A single walkthrough performed with the system administrator
  2. The absence of any reported incidents in the prior quarter
  3. Verbal assurances from the IT manager that controls have never failed
  4. A recent independent assurance report with no exceptions plus a stable, well-documented control environment Correct answer.

Explanation

Reliance decisions rest on the strength of the control environment and on independent, recent evidence of operating effectiveness. A clean independent assurance report combined with a stable, documented environment provides that basis. Informal assurances, a single walkthrough, or a short incident-free period are too limited to justify increased reliance.

Question 28Information Systems Auditing Process

During planning, an IS auditor determines that the tolerable deviation rate for an approval control is 5 percent but the expected population deviation rate is estimated at 4 percent. What is the most appropriate implication for the sampling approach?

  1. The control can be relied upon without sampling since the expected rate is under the threshold
  2. A larger sample size is needed because the margin between expected and tolerable deviation rates is narrow Correct answer.
  3. Attribute sampling is inappropriate and the auditor must switch to discovery sampling
  4. A smaller sample is acceptable because the expected rate is below the tolerable rate

Explanation

When the expected deviation rate approaches the tolerable rate, the auditor has little cushion, so a larger sample is required to keep sampling risk at an acceptable level. Merely being below the tolerable rate does not permit reduced testing, and reliance still requires evidence.

Question 29Information Systems Auditing Process

An IS auditor is evaluating the results of tests of a manual reconciliation control and finds deviations that appear concentrated in one processing location. Which action best reflects an appropriate audit response?

  1. Investigate the cause of the clustered deviations and consider extending testing at that location Correct answer.
  2. Immediately issue a qualified opinion without further analysis
  3. Disregard the deviations because the overall population deviation rate is low
  4. Average the deviations across all locations and conclude the control is effective overall

Explanation

Deviations concentrated in one location suggest a localized control breakdown that averaging would conceal. The auditor should determine the cause and extend procedures in that area before concluding. Aggregating away the pattern or drawing conclusions without analysis would misstate the control's effectiveness.

Question 30Information Systems Auditing Process

An IS auditor needs to test whether an automated three-way match control rejects invoices lacking a valid purchase order throughout the year. Which approach provides the strongest evidence of operating effectiveness?

  1. Interview the accounts payable supervisor about how the control behaves
  2. Obtain the developer's specification document describing the matching rules
  3. Review the project plan from when the matching module was implemented
  4. Re-perform the control logic using test data covering valid and invalid invoices and inspect exception logs Correct answer.

Explanation

Re-performance with test data, combined with inspection of exception logs across the period, directly demonstrates that the control functions as designed. Specifications, interviews, and implementation plans describe intended or historical design but do not prove ongoing operation.

Question 31Information Systems Auditing Process

An IS auditor wants to select journal entries most likely to contain unusual or high-risk postings for substantive testing. Which technique is most appropriate?

  1. Review the chart of accounts to understand account classifications
  2. Inspect the segregation of duties matrix for the general ledger team
  3. Apply data analytics to filter entries posted at unusual times, by unusual users, or with round-dollar amounts Correct answer.
  4. Select a simple random sample of all journal entries for the year

Explanation

Risk-based analytics target characteristics associated with fraud or error, such as off-hours postings, unusual preparers, and round amounts, focusing effort where misstatement is most likely. Random sampling and design reviews do not direct attention to anomalous entries.

Question 32Information Systems Auditing Process

An IS auditor is documenting workpapers for an engagement. Which practice best supports the conclusion that the evidence gathered is sufficient and appropriate?

  1. Cross-referencing each workpaper to the specific audit objective and conclusion it supports Correct answer.
  2. Recording conclusions verbally with the auditee rather than in the file
  3. Retaining only final screenshots without noting the source system and extraction date
  4. Storing workpapers on the auditee's shared drive for convenience

Explanation

Workpapers should be organized so each piece of evidence links to the objective and conclusion it supports, enabling review and re-performance. Evidence without provenance, undocumented conclusions, or storage controlled by the auditee undermines reliability and independence.

Question 33Information Systems Auditing Process

An IS auditor is assessing the risk that a newly implemented interface between payroll and the general ledger fails to transmit all records. Which audit approach best addresses this completeness risk?

  1. Reconcile record counts and control totals between source and target systems over a test period Correct answer.
  2. Inspect the change ticket approving the interface deployment
  3. Review the interface design document for field mappings
  4. Interview the interface developer about error handling

Explanation

Completeness risk is addressed by comparing what left the source with what arrived at the destination, using record counts and control totals. Design documents, developer interviews, and change tickets address design and authorization rather than whether all records transferred.

Question 34Information Systems Auditing Process

An IS auditor suspects that a privileged user bypassed application controls by directly updating the database. Which combination of procedures best tests this hypothesis?

  1. Interview the database administrator about standard operating procedures
  2. Review the application's user access matrix for segregation of duties
  3. Inspect the database vendor's security certification
  4. Compare database transaction logs against application audit trails and review direct-access change records Correct answer.

Explanation

Correlating database logs with application audit trails can reveal activity that bypassed the application layer, and direct-access change records show whether such changes were authorized. Access matrices, certifications, and interviews address design or policy but cannot detect the suspected activity.

Question 35Information Systems Auditing Process

An IS auditor finds that a compensating control is the only safeguard mitigating a known weakness in a legacy system. Which consideration is most important before concluding the residual risk is acceptable?

  1. Whether management has documented the weakness in the risk register
  2. Whether the legacy system is scheduled for replacement within three years
  3. Whether the compensating control was recommended by the vendor
  4. Whether the compensating control is itself reliable and operates consistently across the relevant period Correct answer.

Explanation

A compensating control reduces residual risk only to the extent it is effective and consistently applied; otherwise the underlying weakness remains unmitigated. Replacement timelines, documentation, and vendor recommendations do not establish that the safeguard actually works.

Question 36Information Systems Auditing Process

An IS auditor is preparing the audit program for an engagement covering a cloud-hosted ERP system. Which element belongs in the audit program rather than in the engagement charter?

  1. The specific procedures, sample sizes, and evidence to be gathered for each control objective Correct answer.
  2. The authority of the audit function to access vendor records
  3. The overall objectives and scope boundaries of the engagement
  4. The reporting lines between the audit function and the audit committee

Explanation

The audit program translates objectives into detailed procedures, sampling decisions, and evidence requirements. Authority, scope boundaries, and reporting lines are governance matters established in the charter or engagement letter.

Question 37Governance & Management of IT

An IS audit charter is MOST important because it:

  1. authorizes the audit function's purpose, authority and reporting lines Correct answer.
  2. specifies the sample sizes the auditor must apply to each control
  3. defines the technical standards used to configure the audit tools
  4. lists the individual audit findings from the prior audit cycle

Explanation

The charter is the governing document that establishes the internal audit activity's mandate, its access to records and people, and its reporting relationship, usually to the audit committee. Without it, the auditor's authority to examine IT systems and demand evidence can be challenged by management.

Question 38Governance & Management of IT

Which structure best supports the independence of an IT audit function?

  1. Reporting administratively to the CIO and functionally to the audit committee Correct answer.
  2. Reporting functionally to the IT operations manager and administratively to HR
  3. Reporting administratively and functionally to the chief information officer
  4. Reporting to the project steering committee of the system being audited

Explanation

Functional reporting to the audit committee preserves the auditor's ability to set scope and escalate findings without management filtering, while administrative reporting to an executive handles budgets and HR. Reporting to the CIO alone compromises independence because the auditor would assess the area that controls their career.

Question 39Governance & Management of IT

An organization's IT strategy document contains no measurable targets and no linkage to business objectives. Which governance weakness does this represent MOST directly?

  1. Inadequate alignment of IT direction with enterprise goals Correct answer.
  2. Insufficient capacity planning for network bandwidth
  3. Weak physical access control at the data center
  4. Excessive segregation of duties within the IT function

Explanation

An IT strategy must translate business objectives into measurable IT goals so that investment and performance can be steered. A strategy without targets or business linkage gives the board no basis to direct or evaluate IT, which is a core governance failure rather than an operational control gap.

Question 40Governance & Management of IT

In a COBIT-style governance framework, which element defines the desired outcome of a governance or management objective and provides a basis for measuring it?

  1. The audit universe used to schedule engagements
  2. The service level agreement with the outsourced provider
  3. The enterprise goal cascade linking stakeholder needs to IT goals Correct answer.
  4. The risk register maintained by the security team

Explanation

Governance frameworks cascade stakeholder needs into enterprise goals, then into IT-related goals and enablers, giving auditors a traceable chain to test whether IT activity actually supports the business. The other items are inputs or instruments used within individual processes, not the outcome-defining structure.

Question 41Governance & Management of IT

An auditor finds that the IT steering committee met only twice in a year, minutes record no decisions, and projects proceeded without its approval. The MOST significant governance concern is that:

  1. meeting frequency breaches the vendor's support agreement
  2. the committee members lack the technical skills for the topics
  3. project managers were not trained on the development methodology
  4. IT investment decisions lack documented oversight and accountability Correct answer.

Explanation

A steering committee exists to prioritize and approve IT investment and to hold delivery accountable. Infrequent meetings and absent decisions mean significant spend proceeds without oversight, which is a governance and accountability gap at the board or executive level.

Question 42Governance & Management of IT

Which metric is a lagging indicator of IT governance effectiveness?

  1. Count of change requests awaiting approval today
  2. Percentage of IT projects that delivered planned benefits in the last fiscal year Correct answer.
  3. Volume of service desk tickets logged this morning
  4. Number of open high-severity incidents in the current week

Explanation

Benefit realization is measured after projects complete, so it reports on results already achieved and is therefore lagging. The other measures describe current operational state and can move within hours or days, which makes them leading or real-time indicators.

Question 43Governance & Management of IT

A risk assessment for audit planning should PRIMARILY determine:

  1. the format of the final report issued to the audit committee
  2. the likelihood and impact of IT failures against business objectives Correct answer.
  3. the software tools the audit team will use for data analysis
  4. the number of auditors required to complete each engagement

Explanation

Risk-based audit planning ranks auditable areas by the likelihood and business impact of failure so that limited audit resources target the highest exposure. Staffing, tooling and reporting format are later planning decisions that follow from the risk-ranked plan.

Question 44Governance & Management of IT

An auditor is assessing whether an organization's IT policies are effective. Which evidence provides the STRONGEST assurance?

  1. An email from the CIO stating that policies are enforced
  2. A consultant's opinion that the policy set is comprehensive
  3. Approved policies plus samples showing staff acknowledge and apply them Correct answer.
  4. A complete, well-formatted policy manual dated this year

Explanation

Policy effectiveness requires both an approved standard and evidence of operation, such as acknowledgements and observed compliance in sampled transactions. A document alone shows design intent, not that the control works in practice.

Question 45Governance & Management of IT

An organization outsources its payment processing to a service provider. Which arrangement BEST preserves the organization's accountability for the outsourced controls?

  1. Reliance on the provider's marketing statements about compliance
  2. Contractual right to audit and review of independent assurance reports Correct answer.
  3. Annual verbal confirmation from the provider's account manager
  4. Transfer of all security responsibility to the provider by contract

Explanation

Outsourcing transfers execution but not accountability, so the organization must retain the right to audit and obtain independent assurance over the provider's controls. Contractual transfer of responsibility and informal assurances leave the organization unable to demonstrate oversight to regulators or the board.

Question 46Governance & Management of IT

Which is a PRIMARY responsibility of the board's audit committee regarding IT?

  1. Overseeing IT risk and the adequacy of the control environment Correct answer.
  2. Approving individual firewall rule changes
  3. Performing the daily backup verification
  4. Configuring the enterprise resource planning system

Explanation

The audit committee provides oversight of financial and IT risk, the control environment, and the independence of assurance providers. Technical configuration and operational tasks are management responsibilities far below the oversight layer.

Question 47Governance & Management of IT

An IS auditor reviewing IT governance finds that the CIO approves the IT risk appetite, sets the risk tolerance, and also accepts residual risks. Which conclusion is MOST appropriate?

  1. The arrangement is acceptable because the CIO owns all IT risk
  2. The arrangement is acceptable if the CIO documents each acceptance
  3. Risk appetite setting should be delegated to the internal audit function
  4. Risk appetite should be set at board level with acceptance authority separated from the CIO Correct answer.

Explanation

Setting risk appetite is a governing body decision, and accepting residual risk should be separated from the executive who owns and is rewarded for the risk-taking activity. Concentrating appetite setting and acceptance in the CIO removes the challenge function and weakens accountability.

Question 48Governance & Management of IT

Which control BEST addresses the risk that a departing IT administrator retains access after termination?

  1. A password complexity standard requiring twelve characters
  2. A quarterly review of privileged activity logs
  3. A leaver process triggered by HR that removes access within a defined window and is reconciled to the HR system Correct answer.
  4. An annual access recertification performed by line managers

Explanation

Timely revocation depends on an automated or tightly coupled HR-to-identity process with reconciliation so that every leaver is matched to a completed deprovisioning action. Annual recertification allows up to a year of exposure, and detective log review does not prevent the access.

Question 49Governance & Management of IT

An auditor is asked to join the team implementing a new governance tool and to later audit its implementation. The auditor should:

  1. accept the role and delegate the future audit to a junior team member
  2. accept the role but exclude the implementation from future audit scope
  3. accept the role because technical knowledge improves the audit
  4. decline the implementation role to preserve objectivity for the future audit Correct answer.

Explanation

Performing management functions creates a self-review threat that impairs the auditor's objectivity when the same work is later audited. The safeguard is to avoid the implementation role, or at minimum to ensure an independent party performs the subsequent assurance work.

Question 50Governance & Management of IT

An organization has no formal IT governance framework. Which approach should the IS auditor recommend FIRST?

  1. Wait until the next strategic planning cycle before any action
  2. Implement every process in the framework at full maturity immediately
  3. Delegate framework selection entirely to the external software vendor
  4. Adopt a recognized framework and tailor it to the organization's size and risk profile Correct answer.

Explanation

Frameworks are reference models that must be tailored; adopting a recognized one and scoping it to the organization's risk and scale gives a structured starting point. Full-maturity implementation at once is impractical, and vendor-led selection cedes governance to a party with a commercial interest.