Certified Information Systems Auditor

An IS auditor concludes that control risk is high for a key process. Holding audit risk constant, what must the auditor do to detection risk?

An auditor is engaged to review a system that the same audit firm designed two years earlier. Which safeguard is MOST appropriate?

An auditor tests 50 change records and finds 4 without evidence of approval. Management explains that 3 relate to one contractor who has since left. What is the MOST appropriate next step?

Which combination of evidence provides the STRONGEST basis for concluding that terminated employees' access was removed timely?

An auditor plans to rely on a control self-assessment programme to reduce substantive testing. What must be evaluated FIRST?

During an audit the auditor identifies a material weakness that management asks to omit because remediation is already funded and scheduled. The auditor should:

Which situation MOST undermines the value of an exception report as audit evidence?

An auditor must conclude on whether a control operated throughout a 12-month period but can obtain evidence only for the final quarter because logs were overwritten. What should be reported?

Which sampling approach is appropriate when the auditor must estimate the frequency with which an approval control was bypassed?

An auditor uses generalized audit software to test 100% of a transaction population. Which risk is eliminated and which remains?