ISACA CISA Review Manual - Chapter 1: Information System Auditing Process & Overview

Under the 2019 CISA Job Practice, what percentage weighting is assigned to each of the five exam domains?

Domain 1 (Information System Auditing Process): $21\%$, Domain 2 (Governance and Management of IT): $17\%$, Domain 3 (Information Systems Acquisition, Development and Implementation): $12\%$, Domain 4 (Information Systems Operations and Business Resilience): $23\%$, and Domain 5 (Protection of Information Assets): $27\%$.

Which document outlines the overall authority, responsibility, and accountability to perform an IS audit?

The approved audit charter.

Who is required to approve the IS audit charter?

The highest level of management (such as the board of directors) and the audit committee, if one exists.

What is the key difference between an audit charter and an engagement letter?

An audit charter is an overarching document that covers the entire scope of audit activities within an entity, whereas an engagement letter is focused on a particular audit exercise initiated with a specific objective in mind.

In performing a risk-based audit, which risk assessment must be completed first by an IS auditor?

Inherent risk assessment.

How is inherent risk defined in the context of an IS audit?

Inherent risk is the risk level or exposure that exists independently of an audit and assumes an absence of compensating controls in the area being reviewed, occurring because of the nature of the business or without considering actions management has taken or might take.

What is control risk in an IS audit?

The risk that a material error exists that will not be prevented or detected in a timely manner by the system of internal controls.

What is detection risk, and what are its two components?

Detection risk is the risk that a material misstatement within a management assertion will not be detected by an auditor's substantive tests. It consists of two components: sampling risk and nonsampling risk.

What action should an IS auditor take if they discover a weakness in system software that could materially impact an application, but system software review is outside the current scope?

Review the system software controls as relevant to the current review and recommend a detailed system software review.

What is the most important reason why an audit planning process should be reviewed at periodic intervals?

To consider changes to the risk environment, technologies, and business processes of the enterprise.

Which method is considered most effective for implementing a control self-assessment (CSA) within small business units?

Facilitated workshops.

What is the first step an IS auditor should perform when planning an IS audit?

Gain an understanding of the organization's mission, objectives, purpose, and processes.

On what primary basis should an IS auditor plan IS audit coverage?

A risk-based approach (risk).

An organization performs a daily backup of critical files and stores the tapes offsite to restore files after a disruption. What type of control is this?

A corrective control, because it helps to correct or minimize the impact of a problem by restoring files.

What are the three major phases of the typical audit process identified by ISACA?

Planning, Fieldwork/Documentation, and Reporting/Follow-up.

How does ISACA distinguish between information systems (IS) and information technology (IT)?

An information system (IS) is the combination of strategic, managerial, and operational activities and related processes involved in gathering, processing, storing, distributing, and using information; it has an IT component that interacts with process components. Information technology (IT) is defined as the hardware, software, communication, and other facilities used to input, store, process, transmit, and output data in whatever form.

What are the three categories of ISACA IS Audit and Assurance Standards?

General standards (guiding principles regarding ethics, independence, objectivity, due care, knowledge, competency, and skill), Performance standards (conduct of the assignment including planning, scoping, risk, materiality, evidence, and professional judgment), and Reporting standards (types of reports, means of communication, and information communicated).

What is the operational difference between ISACA Standards and ISACA Guidelines?

Standards define mandatory requirements for IS audit, assurance, and reporting, whereas Guidelines provide guidance on implementing the standards. An auditor may use professional judgment when applying guidelines but must be prepared to justify any departure from the standards.

What is the purpose of ITAF (Information Technology Assurance Framework)?

ITAF is a comprehensive and good practice-setting reference model that establishes standards addressing IS auditor roles, responsibilities, skills, conduct, and reporting; defines terms and concepts specific to IS assurance; and