Chapter 4: IT Audit Process

Question 1

key part of a good process

Answer 1

having an overall audit schedule

Question 2

should be readily available to let everyone
know when each process will be audited over the upcoming cycle (usually a yearly schedule).

Answer 2

overall audit schedule

Question 3

the message is that this is meant as a support to the process owners and the auditors are there to help

Answer 3

publishing the audit intentions

Question 4

can allow the process owners to time the finish of any improvement projects that they are working on to be before the audit, so that they can gather valuable information on the implementation, or to request the auditors to focus on helping to gather information for other planned improvements

Answer 4

publishing the audit intentions

Question 5

first step in planning the individual process audits

Answer 5

confirm with the process owners when the audit will take place

Question 6

is more of a guideline as to how often processes will be audited, and roughly when

Answer 6

overall plan/ overall audit schedule

Question 7

allows the auditor and process owner to collaborate to determine the best time to review the process

Answer 7

confirmation

Question 8

This is when the auditor can review previous audits to see if any follow-up is required on comments or concerns previously found, and when the process owner can identify any areas that the auditor can look at to assist the process owner to identify information.

Answer 8

confirmation

Question 9

can make sure that the process owner will get value out of the audit process

Answer 9

good audit plan

Question 10

two major steps in planning the IT Audit

Answer 10

1. gather information and do some
   planning
2. gain an understanding of the existing internal control structure

Question 11

is used to assess risk and helps an IT auditor make the decision as to whether to perform compliance testing or substantive testing

Answer 11

risk-based audit approach

Question 12

in this approach, IT auditors are relying on internal and operational controls as well as the knowledge of the company or the business

Answer 12

risk-based audit approach

Question 13

can help relate the cost-benefit analysis of the control to the known risk

Answer 13

risk-based audit approach

Question 14

five items in the “Gathering Information” step the IT auditor needs

Answer 14

a. Knowledge of business and industry
b. Prior year’s audit results
c. Recent financial information
d. Regulatory statutes
e. Inherent risk assessments

Question 15

the risk that an error exists that could be material or significant when combined with other errors encountered during the audit, assuming there are no related compensating controls

Answer 15

Inherent risks

Question 16

exist independent of the audit and can occur because of the nature of the business

Answer 16

Inherent risks

Question 17

five items in the “Gain an Understanding of the Existing Internal Control Structure” step that the IT auditor needs

Answer 17

a. Control Environment
b. Control Procedures
c. Detection Risk Assessment
d. Control Risk Assessment
e. Equate Total Risk

Question 18

one of the key pieces of information that you will need in the initial steps in planning an IT Audit

Answer 18

current Business Impact Analysis (BIA)

Question 19

assist you in selecting the application which support the most critical or sensitive business functions

Answer 19

current Business Impact Analysis (BIA)

Question 20

should start with a meeting of the process owner to make sure that the audit plan is complete and ready

Answer 20

audit

Question 21

avenues for the auditor to gather information during the audit

Answer 21

reviewing records, talking to employees, analyzing key process data or even observing the process in action

Question 22

One of the most valuable things that an
auditor can do for a process owner

Answer 22

point out areas of a process that may function better if changes are made

Question 23

is a necessity to ensure that the flow of information is not delayed

Answer 23

closing meeting with the process owner

Question 24

will want to know if there are any areas of weakness that need to be addressed, but will also be interested in knowing if any areas exist that might be improved

Answer 24

process owner

Question 25

is a critical step

Answer 25

follow-up

Question 26

key part of fixing the problems found

Answer 26

make sure that the problem is ACTUALLY fixed

Question 27

five audit process

Answer 27

1. Planning the Audit Schedule 2. Planning the Process Audit 3. Conducting the Audit 4. Reporting on the Audit 5. Follow-up on Issues or Improvements Found

Question 28

4 Phases of an IT Audit

Answer 28

1. Audit Planning 2. Tests of Controls 3. Substantive Testing 4. Audit Report

Question 29

first step in an IT audit

Answer 29

audit planning

Question 30

analysis of audit risk

Answer 30

major part in audit planning phase

Question 31

objective of the auditor in IT Audit

Answer 31

to obtain sufficient information about the firm to plan the other phases of the audit

Question 32

incorporates an overview of the organization’s internal controls

Answer 32

risk analysis

Question 33

phase of an IT audit where the auditor attempts to understand the organization’s policies, practices, and structure; and also identifies the financial attempts to understand the controls over the primary transactions that are processed by these applications

Answer 33

audit planning

Question 34

techniques for gathering evidence in audit planning phase

Answer 34

questionnaires, interviewing management, reviewing systems documentation, and observing activities

Question 35

a phase where the auditor tests t controls for compliance with preestablished standards

Answer 35

tests of controls

Question 36

objective of the tests of controls phase

Answer 36

to determine whether adequate internal controls are in place and functioning properly

Question 37

The evidence gathering techniques used in this phase may include both manual techniques and specialized computer audit techniques

Answer 37

tests of controls

Question 38

this affects the nature and extent of substantive testing that needs to be performed

Answer 38

degree of reliance the auditor can ascribe to internal controls