A bank's audit function wants to introduce continuous auditing of card transactions. Which condition is MOST important for this to work?
Question 2Audit data analytics
An IS auditor at a hospital system wants to identify duplicate vendor payments among two million payment records from the past three years. What is the MOST effective approach?
Question 3Audit data analytics
An IS auditor at an insurance company uses generalized audit software to test claim payments. What is the PRIMARY advantage of this approach?
Question 4Audit evidence collection techniques
The IT manager at a logistics company tells the IS auditor that every security patch is tested before deployment. What should the auditor do NEXT?
Question 5Audit evidence collection techniques
An IS auditor is concluding on password settings across 40 Linux servers at a university. The only evidence is a screenshot of the configuration on one server. What is the GREATEST concern?
Question 6Audit project management
The IT team at a regional bank has delayed providing requested system reports for three weeks, and the audit deadline is close. Repeated reminders have not helped. What is the BEST next step?
Question 7Audit project management
A staff auditor is reassigned midway through an audit of a city's tax collection system, and another auditor will finish the work. What MOST helps the new auditor continue without repeating work?
Question 8Audit project management
An IS auditor is preparing the audit work program for a review of a cloud provider's key management service. What is MOST important for the program to contain?
Question 9Audit testing and sampling methodology
An IS auditor at an online bank wants to reduce the sample size for an attribute test of access approvals. Which change, with other factors held constant, would allow this?
Question 10Audit testing and sampling methodology
An IS auditor at a manufacturer will select 60 purchase orders from a numbered population of 12,000 using systematic selection. Which approach is correct?
Question 11Audit testing and sampling methodology
An IS auditor at a distributor wants to estimate the total dollar amount by which inventory values in the warehouse system may be overstated. Which sampling method BEST fits this objective?
Question 12Types of controls and considerations
Which of the following at a mortgage lender is an application control rather than a general IT control?
Question 13Types of controls and considerations
A retailer is replacing a manual review of refunds over a set amount with an automated block in the point-of-sale system. What is the PRIMARY advantage of the automated control?
Question 14Types of controls and considerations
A government agency's database administrators can modify production data directly. Management says a weekly review of database change logs by the data owner compensates for this. What should the IS auditor do?
Question 15Types of controls and considerations
A hospital needs clinicians to have broad access in emergencies, but it wants to find cases where staff viewed records of patients not in their care. Which control is detective?
Question 16Types of controls and considerations
A manufacturer wants to stop unauthorized changes to supplier bank details in its vendor master file. Which control is preventive?
Question 17Risk-based audit planning
The head of IS audit at a regional hospital network has six auditors and over 150 applications in the audit universe. What is the BEST basis for choosing which applications to audit next year?
Question 18Risk-based audit planning
An IS auditor reviews how a university maintains its audit universe. Which finding is the GREATEST concern?
Question 19Audit standards, guidelines and codes of ethics
A software vendor bidding to replace a retailer's point-of-sale system asks the IS auditor for a copy of last quarter's audit findings on that system, saying it would help them tailor the proposal. How should the auditor respond?
Question 20Audit standards, guidelines and codes of ethics
An IS auditor is reviewing the configuration of a startup's cloud storage accounts. The company has no internal configuration standard. What is the BEST basis for the audit criteria?
Question 21Types of audits, assessments and reviews
A university relies on a cloud provider's SOC 2 Type 2 report covering January through June. The university's own reporting year ends 31 December. What should the IS auditor do about the July to December gap?
Question 22Types of audits, assessments and reviews
A credit union's audit team will examine its loan approval process, covering both the business approval steps and the IT controls in the lending system that support them. Which type of audit is this?
Question 23Quality assurance and improvement of the audit process
A new chief audit executive at a large university wants to establish a quality assurance and improvement program for the audit function. Which approach BEST achieves this?
Question 24Quality assurance and improvement of the audit process
During a quality review of a manufacturer's IS audit function, which observation is the GREATEST concern?
Question 25Reporting and communication techniques
The final IS audit report on network security at a hospital contains detailed descriptions of exploitable weaknesses. Who should receive it?
Question 26Reporting and communication techniques
An IS audit of a city government's permitting system is nearly complete. What is the PRIMARY purpose of the exit meeting with management?
Question 27Reporting and communication techniques
Management at a credit card issuer reports that a high-risk audit finding about firewall rule reviews has been remediated. What should the IS auditor do before closing the finding?
Question 28Reporting and communication techniques
After an audit at a logistics company, the IT manager asks the IS auditor to configure the corrective firewall rules, since the auditor understands the issue best. What should the auditor do?