ICAI DISA 3.0 MOdule 1 Quiz ICAI DISA 3.0 MOdule 1 Quiz ICAI DISA 3.0 QUIZ MODULE 1 1 / 27 1. What will be the immediate step once the business process to be audited is identified? To determine the audit universe. To determine the audit resources. To determine the key stakeholders. To determine the control objectives and activities. Explanation: Once the business process to be audited is identified, the next step is to identify the control objectives and activities associated with the business processes. The next step is to identify the audit resources. The audit universe is to be determined prior to the finalization of the audit scope. 2 / 27 2. Which of the following is the first step in performing risk assessments of information systems? Reviewing the appropriateness of existing controls. Reviewing the effectiveness of existing controls. Reviewing the asset-related risk surveillance mechanism. Reviewing the threats and vulnerabilities impacting the assets. Explanation: The identification of vulnerabilities and threats is the first step in a risk assessment process. Once the threats and vulnerabilities are identified, the auditor should evaluate existing controls and their effectiveness to draw a conclusion about the residual risk. Continuous risk monitoring is implemented during the risk monitoring function. 3 / 27 3. ITF is best used for: The verification of system processing. The verification of system integration. The generation of test data. The continuous auditing of system data. Explanation: In the ITF technique, a test transaction is entered. The processing results of the test transaction are compared with the expected results to determine the accuracy of the processing. If the processed results match the expected results, then it determines that processing is happening correctly. 4 / 27 4. What are some key reasons for auditors to rely upon the use of CAAT tools in the task of auditing? Computers are more prone to make errors in handling subjective big data. There is more scope for fraud & error in a computerized environment. Data may be entered into the system without supporting documents. There is no choice since most operations are computerized. Data may be entered directly into the computer system without supporting documents. In some on-line transaction systems written evidence of data entry authorization (for example, approval for order entry) may be replaced by other procedures, such as authorization controls contained in computer programs (for example, credit limit approval). Hence; the answer in Option C is the correct one. 5 / 27 5. The first step to review a service-oriented application is: To understand services and their allocation to business processes. To review the coding process in accordance with service security standards. To review the service level agreement. To audit the application security procedure Explanation: Service-level architecture relies on the principle of multiple clients. The first step of the assignment is to understand how the services are allocated to different business units. Once this is done, the auditor will have a sufficient idea about the risk environment on the basis of which further audit procedures can be developed. 6 / 27 6. Which of the following is the best course of action if it is not possible to cover the total audit scope due to resource constraints? Concentrate on last years audit findings. Rely on the management assurance of internal controls. Focus on high-risk areas. Concentrate on the effectiveness of controls Question 22. Explanation: The best course of action is to reduce the audit scope and to focus on high-risk areas. The other options do not concentrate on areas where more audit focus is required. 7 / 27 7. The best evidence to determine the effectiveness of control involving the review of system generated exceptional reports is: A walkthrough of the control process. Approved documented control process. A sample exception report along with a follow-up action plan. Management assurance. Explanation: A review of the exception report along with a follow-up action represents the best possible evidence. It determines that the control process is in place and also follow-up actions are taken for exceptions. 8 / 27 8. Barriers or warning signs are examples of what kind of control? Preventive control. Detective control. Corrective control. Deterrent control. Explanation: A deterrent control is anything intended to warn a potential attacker not to attack. 9 / 27 9. The requirement of biometric access for physical facilities is an example of what kind of control? Preventive control. Detective control. Corrective control. Deterrent control. Explanation: Access control aims to prevent access by unauthorized persons. It prevents omissions, errors, or malicious acts from occurring. 10 / 27 10. 11 / 27 11. The best audit method when an audit trail is required is: SCARF. CIS. Audit hooks. Snapshots. Explanation: The snapshots technique captures snaps or pictures of the transaction as it is processed at different stages in the system. Details are captured both before the execution and after the execution of the transaction. The correctness of the transaction is verified by validating the before-processing and after processing snaps of the transactions. Snapshot is useful when an audit trail is required. 12 / 27 12. While reviewing a change management process, it is observed that the number of changes that are available for sampling does not give reasonable assurance. What is the best option for the IS auditor? To design an alternative test procedure. To publish the report on the basis of the samples available. To conduct an interview with the staff associated with the process. To create a dummy sample for verification. Explanation: If the sample size is insufficient, the auditor should develop an alternative test procedure to evaluate the change management process. 13 / 27 13. Application controls shall include all except Application controls are a subset of internal controls. The purpose is to collect timely; accurate and reliable information. It is part of the of IS Auditor’s responsibility to implement the same. It is part of business application software. Represents what auditor’s verifies but not that what he/she implements. Rest is part of definition and purpose of application controls. 14 / 27 14. An IS auditor has determined a few vulnerabilities in a critical application. What should their next step be? Reporting the risk to the audit committee immediately. Determining a system development methodology. Identifying threats and their likelihood of occurrence. Recommending the development of a new system. Explanation: Once the critical assets are identified, the next step is to determine vulnerabilities and then to look at threats and their probability of occurrence. 15 / 27 15. What is the process of using well-designed documentation to prevent errors an example of? Preventive control. Detective control. Corrective control. Deterrent control. Explanation: Well-designed documents are an attempt to prevent errors by implementing efficient and effective operational procedures in the organization. 16 / 27 16. The most reliable source of information when designing a risk- based audit plan is: Key controls identified by the process owner. The key business process identified by senior management. Vulnerabilities identified by the process owner. The previous audit findings. Explanation: To design a risk-based audit plan, identification of the key business process is very important to determine the area of audit focus. Once the key business process is identified, the other options can be evaluated for further information. 17 / 27 17. To review the adequacy of management’s remediation action plan, the most important factor is: The approval of the remediation action by senior management. The man-days required for future audit work. Potential cost savings. The criticality of the audit findings. Explanation: A remediation action plan should be in line with the criticality of the audit findings. 18 / 27 18. The main reason for meeting with auditees before formally releasing the audit report is to: Ensure all the important issues are covered. Gain agreement on the findings. Obtain feedback on the audit procedures. Finalize the structure of the final audit report. Explanation: The goal of such a discussion is to confirm the relevance and accuracy of the audit observation and to discuss a course of correct. 19 / 27 19. An IS auditor has observed inadequate controls of remote access for a critical application. The auditor should: Revise the finding, considering the management views. Withdraw the finding because the IDS controls are in place. Withdraw the finding because firewall rules are monitored. Document the audit findings in the audit report. Explanation: The IS auditor should take into account the management view; however, they should independently evaluate the risk related to the audit findings. Normally, an IS auditor would not automatically delete or revise the findings. 20 / 27 20. Which of the following should an IS auditor do when an auditee has taken immediate corrective action of audit findings? Exclude the finding from the final report without verifying the corrective action. Report the observation and risk in the final report. Verify the correction and if appropriately closed, it should be excluded from the report. A call of the inclusion/exclusion should be taken after a discussion of the finding with auditee management. Explanation: It is advisable to report the finding even if corrective action is taken by the auditee. For any action taken on the basis of audit observation, the audit report should identify the finding and describe the corrective action taken. 21 / 27 21. After initial investigation; IS auditor has reasons to believe that there is possibility of fraud; the IS auditor has to: Expand activities to determine whether an investigation is warranted. Report the matter to the audit committee. Report the possibility of fraud to top management and ask how they would like to proceed. Consult with external legal counsel to determine the course of action to be taken. A holistic approach to deterrence and prevention of fraud would require strengthening of governance and management framework. The answers in options B to D address the issue in bits and pieces and; hence; are not the right answers. Answer at Option A alone is correct. 22 / 27 22. As a measure of IT General control; an organization decides to separate those who can run live programs (e.g. Operations department) from those who can change programs (e.g. programmers). Is this a good move ? Why ? Yes; it is a good move; it can help prevent unauthorised programs from being run No; it is not a good move; the user dept. knows best & should be allowed to change programs Yes; it is a good move; since the programmers would have no work to do otherwise No; it is not a good move; significant time would be lost in the process & potential savings lost Responsibility for IT systems should lie with the top management with appropriate delegation to lower levels. This would not only ensure that the highly vulnerable IT systems are properly controlled at the highest levels in the company but also ensure that appropriate IT policies are framed; keeping in mind organizational objectives and goals. The perspective of an accountant; whether junior or senior; would be rather limited to his area of operations and responsibility; it may lack the breadth of vision which would be essential at the top management level as also the interfaces between various functions in the business. In any professional organization; no positive bias can be allowed for the dominance of so-called ‘family retainers’ however trustworthy they may be. The operations have to be system driven & not personality driven. Hence; theanswer in Option A is correct. 23 / 27 23. A check subroutine that identifies an error and makes a correction before enabling the process to continue is an example of what kind of control? Preventive control Detective control Corrective control Deterrent control Explanation: The check subroutine corrects the error. It modifies the processing system and minimizes the likelihood of future occurrences of the problem. 24 / 27 24. The cashier of a company has rights to create bank master in TALLY. This error is a reflection of poor definition for which type of control: User Controls Application Control Input Control Output Control User controls are not properly defined. User controls need to be defined based on NEED TO DO and NEED TO DO basis. The above is reflection of a greater problem of improper assessment of user profiles created in the system. 25 / 27 25. Which of the following is the most important aspect of planning an audit? Identifying high-risk processes Identifying the experience and capabilities of audit staff Identifying control testing procedures of the audit Determining the audit schedule Explanation: The identification of high-risk areas within the audit scope is the first step in the audit procedure. Audit planning can be done in accordance with the findings regarding the risk-prone areas. Risk-based audit planning is designed to ensure that enough audit resources are spent on the risk-prone areas. 26 / 27 26. Which are the business activities which are strong contenders for conversion to e-commerce? Those that are paper-based; time consuming & inconvenient for customers Those relating to software development Those relating to the ‘electronic’ aspects of commerce Those that are not paper-based; speedy & convenient for customers. Maximum mileage can be gained from e-commerce by converting those business activities which are paperbased; time consuming & inconvenient for customers as indicated in Option A. This will help us reduce paperwork; accelerate delivery & make it convenient for customers to operate from the comfort of their homes as also at any other place of their convenience. Hence; the other options are wrong. 27 / 27 27. Which of the following audit tools is MOST useful to an IS auditor when an audit trail is required? Integrated test facility (ITF) Continuous and intermittent simulation (CIS) Audit hooks Snapshots Snapshot is the right answer as in this technique; IS auditor can create evidence through IMAGE capturing. A snapshot tool is most useful when an audit trail is required. ITF can be used to incorporate test transactions into a normal production run of a system. CIS is useful when transactions meeting certain criteria need to be examined. Audit hooks are useful when only select transactions or processes need to be examined. Your score isThe average score is 58% 0% Restart quiz ICAI DISA 3.0 MOdule 1 Quiz Share this:PostLike this:Like Loading...
