CISA Domain 2

Effective IT governance ensures the IT plan is consistent with the enterprise:

• Business plan

• Audit plan

• Security plan

• Investment plan

Responsibility for the governance of IT should rest with the:

• IT strategy committee

• Chief information officer

• Audit committee

• Board of directors

When developing a security architecture, which of the following steps should be executed first?

• Developing security procedures

• Defining a security policy

• Specifying an access control methodology

• Defining roles and responsibilities

The primary benefit of an enterprise architecture initiative is to:

• Enable the enterprise to invest in the most appropriate technology

• Ensure security controls are implemented on critical platforms

• Allow development teams to be more responsive to business requirements

• Provide business units with greater autonomy to select IT solutions that fit their needs

An IS auditor is assigned to review IT structures and activities recently outsourced to various providers. Which of the following should the IS auditor determine first?

• An audit clause is present in all contracts

• The service level agreement of each contract is substantiated by appropriate key performance indicators

• The contractual warranties of the providers support the business needs of the enterprise

• At contract termination, support is guaranteed by each outsourcer for new outsourcers

Which of the following is the PRIMARY objective of a quality assurance (QA) and improvement program for an audit process?

• 1. To ensure that all audit findings are accepted, addressed and resolved on time

• To provide a basis for evaluating the effectiveness and efficiency of the audit process

• 1. To ensure that auditors are adequately trained, qualified and competent to perform audits

• To establish standard procedures for conducting audits, analyzing evidence and reporting findings

An enterprise adopted a policy of periodic verification of IT assets through control self-assessment (CSA). Which of the following is the BEST approach for an information systems (IS) auditor of the enterprise?

• The IS auditor should actively participate in the CSA for asset verification.

• The IS auditor should suggest that the enterprise incentivize the CSA exercise.

• 1. The IS auditor should review the CSA outcome and look for other internal controls in place.

• The IS auditor should recuse from the CSA exercise, citing repetition/redundancy of work.

While reviewing a quality management system, the information systems (IS) auditor should PRIMARILY focus on collecting evidence to show that:

• 1. quality management systems comply with good practices.

• 1. continuous improvement targets are being monitored.

• 1. standard operating procedures are updated annually.

• 1. key performance indicators are defined.

Which of the following is the BEST approach for an information systems (IS) auditor evaluating IT-related controls as a member of an integrated audit team?

• Perform IT audits independently and submit findings to the audit manager to include in the final report.

• Prioritize control testing based on the complexity of the technology implemented by the enterprise.

• 1. Include in the audit report the impact to the business due to weaknesses found in IT controls.

• 1. Discuss the findings with the audit manager and afterwards submit the IT audit report to auditee’s management.

An information systems (IS) auditor uses computer-assisted audit techniques (CAATs) to collect and analyze data. Which of the following attributes of evidence is MOST affected by using CAATs?

• Usefulness

• Reliability

• 1. Relevance

• 1. Adequacy