Chapter 7: Auditing of Information System (Segregated Content)

Information systems have become an integral part of day-to-day life, and organizations are
adapting to technological changes to survive competition, achieve competitive advantage, and
attain operational excellence

. The application of technology gives rise to risks that may be detrimental to the business,
creating a need for Information System Auditing (ISA)

Information Systems Auditing involves evaluating the adequacy and effectiveness of

Information Systems (IS) controls using technical tools and expertise

. The auditor works with management to identify weak controls and risks resulting from the
application of technology and suggests ways to enhance controls to increase IS reliability and
help achieve strategic objectives

--------------------------------------------------------------------------------

Question 1: Define information systems audit. What are the benefits of this audit? What is
CAAT?

Layman Summary: An Information System (IS) audit is a professional review of an organization's

computer systems and IT management practices. It verifies that the systems are properly
protecting assets, ensuring data is accurate (Integrity), and operating effectively to meet
company goals. The main benefits are achieving security, ensuring data reliability, and verifying
proper IT management. CAAT (Computer Assisted Audit Techniques) are specialized software
tools used by auditors to quickly analyze huge amounts of digital data, which is far more
efficient than manual review.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

An examination of management controls within an IT infrastructure,

Define Information
1 evaluating if IS is safeguarding assets, maintaining data Integrity, and
Systems (IT) Audit.
operating effectively to achieve organizational goals

2 What are the three primary Confidentiality (disclosure only to authorized users);
objectives (the triad) evaluated Integrity (accurate, reliable, and timely information); and
 by an IT audit? Availability (systems available when required)

What are the key It provides assurance that IT systems are adequately protected,
3
benefits of an IS audit? provide reliable information to users, and are properly managed

. It helps reduce risks of data tampering, loss, service disruption, and poor IT management

What is CAAT (Computer An auditing method using computer software tools to query
4
Assisted Audit Techniques)? business data and produce reports that enhance an audit

. It is used to analyze large volumes of electronic data for anomalies

What are the Time saving (manual tasks done quickly); produces reliable reports
5 benefits of using (auditors create independent reports); and enables a complete review
CAAT in IS audit? of all transactions (100% detail checking) rather than just samples

--------------------------------------------------------------------------------

Question 2: Discuss various issues that are of primary concern for an auditor involved in
information system audit.

Layman Summary: An IS auditor is concerned with the "total systems environment" from the
start of a transaction until it is recorded. They primarily focus on finding controls to ensure
every transaction can be traced (Audit Trail), confirming data integrity, guaranteeing system
changes and overrides are authorized, ensuring adequate security and recovery procedures,
and verifying that all system designs and implementations adhere to policies and
predetermined criteria.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

What is a primary concern Ensuring provisions for an adequate Audit Trail so

1 regarding transaction transactions can be traced forward and backward
traceability? through the system

.
 What concerns relate to data Controls over the accounting for all data entered into the
2 integrity and accounting system and ensuring the integrity of transactions throughout
controls? the computerized segment of the system

What concerns relate to Control over changes to the computer system to ensure proper
3 system changes and authorization, and establishing authorization procedures for
overrides? system overrides

What concerns relate to Adequate security procedures to protect user data, and
4
infrastructure and security? backup and recovery procedures for system operation

What concerns relate to Testing to determine whether the system performs as stated, and
5 system performance and developing detailed evaluation criteria to determine whether the
evaluation? implemented system has met predetermined specifications

--------------------------------------------------------------------------------

Question 3: What are information systems auditing? What are it objectives?

Layman Summary: (Definition covered in Q1). The objectives of IS Auditing fall into two
categories: attesting (focusing on protection and integrity, important for external reports) and
management (focusing on efficiency and effectiveness, important for internal operations).
Overall, the goal is to make sure IT assets are protected, data is accurate, and resources are
used wisely to meet business needs.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

What are the two major Attesting objectives (focus on asset safeguarding and data
1 sets of objectives in IS integrity) and Management objectives (focus on
Auditing? effectiveness and efficiency)

2 What is the Data Integrity To maintain the integrity of data at all times, which is fundamental
 Objective? for decision-making and competition

To ensure that information system assets (hardware, software,

What is the Asset
3 data, etc.) are protected by a system of internal controls from
Safeguarding Objective?
unauthorized access

What are the System Effectiveness Effectiveness: Auditing system characteristics to ensure
4
and Efficiency Objectives? they meet business and user requirements

. Efficiency: Optimizing the use of IS resources (machine time, software, labor) and minimizing
impact on the computing environment

--------------------------------------------------------------------------------

Question 4: What are the reasons to use risk assessment to determine the areas to be audited.

Layman Summary: Risk assessment is used to strategically manage the audit process. It ensures
the auditor focuses on the most critical threats first, allowing the organization to allocate limited
resources effectively and confirming that the audit work aligns with the overall business
objectives and strategic plans.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Why is risk assessment used to determine audit Enables management to effectively

1
areas? (Resource Management) allocate limited audit resources

Why is risk assessment used Ensures that relevant information is obtained from all levels
2 to determine audit areas? of management, and provides a summary of how the audit
(Relevance & Strategy) subject relates to the overall organization and business plans

Why is risk assessment used to determine Establishes a basis for effectively managing the IT
3
audit areas? (Departmental) audit department/function

.
--------------------------------------------------------------------------------

Question 5: Explain the set of skills that is generally expected of an IS auditor. What is the sole
purpose of audit?

Layman Summary: An IS auditor needs both business acumen (knowing how the company
works) and high technical expertise (understanding IT risks, controls, and best practices). The
entire point of the IS audit is singular: to confirm that automated systems are sufficient to
handle processing needs, that controls are adequate, and that the company’s assets controlled
by IT are protected.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

List three key skills Sound knowledge of business operations, requisite professional
1 expected of an IS technical qualification & certifications, and a good understanding
auditor. of Information Risks & Controls

Knowledge of IT strategies, policy & procedural controls; ability to

List three more key
understand technical & manual controls relating to business continuity;
2 skills expected of an
and knowledge of Professional Standards & Best Practices of IT
IS auditor.
controls & security

To evaluate and review the adequacy of automated information

What is the sole purpose
systems to meet processing needs, evaluate internal controls, and
3 of an Information System
ensure assets controlled by those systems are adequately
audit?
safeguarded

--------------------------------------------------------------------------------

Question 6: What is the scope of IS audit process? Explain major types/ categories of IS Audits in
brief.

Layman Summary: The scope of an IS audit covers everything from the effectiveness of internal
controls to the quality of the system's performance, including how IT is planned and organized.
Audits are categorized based on what they are checking: the specific software application, the
physical data center, the process for developing new systems, the network, or the overall
management structure of the IT department.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Examination and evaluation of the adequacy and effectiveness of

What is the scope of
1 internal controls and the quality of performance by the
the IS audit process?
information system

. It includes controls for the use and protection of information and resources (data, applications,
facilities, people)

Verifies that systems & applications are appropriate, efficient, and

Category: Systems &
2 adequately controlled for valid, reliable, timely, & secure input,
Application Audit
processing, & output

Verifies that the facility is controlled to ensure timely, accurate,

Category: Information
3 & efficient processing under normal & potentially disruptive
Processing Facilities Audit
conditions

Verifies that systems under development meet organizational

Category: Systems
4 objectives and follow generally accepted standards for
Development Audit
development

Category: Management of IT Verifies that IT management has an organizational structure

5 & Enterprise Architecture and procedures to ensure a controlled & efficient
Audit environment for information processing

--------------------------------------------------------------------------------

Question 7: Describe the various categories of risk.

Layman Summary: Auditors classify risks to understand potential failures. Audit Risk means the
auditor misses a significant error. Inherent Risk is the natural weakness of an asset to be
harmed (regardless of controls). Control Risk is the likelihood that the company's internal
controls will fail to catch an error. Detection Risk is the chance that the auditor's testing
procedures will fail to find an error that actually exists.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

What is Audit The risk that information contains a material error that may go
1
Risk? undetected during the course of the audit

What is The susceptibility of information resources (or resources controlled by the

2
Inherent Risk? IS) to material theft, destruction, disclosure, or unauthorized modification

What is Control The risk that an organization's internal control system will fail to prevent or
3
Risk? detect a material error or gap

What is Detection The risk that the IT auditor’s substantive procedures will not detect an
4
Risk? error which could be material

. (e.g., often high for identifying security breaches because comprehensive logs may not be
unavailable at the time of the audit)

--------------------------------------------------------------------------------

Question 8: Write short notes on information system audit strategy.

Layman Summary: The audit strategy is the initial high-level blueprint that sets the plan for the
entire audit engagement. It defines the direction, timing, and scope, and outlines how resources
will be allocated. It must be based on known factors like reporting goals and characteristics of
the audit, and it serves as the guide for creating the much more detailed audit plan.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

1 What is the purpose of It sets the direction, timing, and scope of an audit, and defines
an IS Audit Strategy? the criteria used to prioritize items in the audit universe and
 allocate resources

Characteristics of the engagement, reporting objectives, timing

What considerations is the
2 of the audit, the nature of communications, and the results of
audit strategy based on?
preliminary activities

How does the audit The strategy sets the general guidelines and direction, while the audit
3 strategy relate to the plan is much more detailed, stating the nature, timing, and extent of
audit plan? the specific audit procedures to be conducted

--------------------------------------------------------------------------------

Question 9: Discuss the phases of information systems audit.

Layman Summary: The IS audit follows a four-step process. 1. Planning (getting permission and
setting the mission via an Audit Charter). 2. Risk Assessment (identifying potential adverse
events to prioritize work). 3. Performance (gathering evidence, testing controls, and
documenting findings). 4. Reporting (communicating the scope, findings, conclusions, and
recommendations to management).

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

What are the four 1. Audit Planning. 2. Risk Assessment and Business Process
1
phases of IS audit? Analysis. 3. Performance of Audit Work. 4. Reporting

To obtain an Audit Charter detailing responsibility, authority (e.g., right to

Key focus of Phase
2 access information), and accountability. Also involves obtaining a written
1 (Audit Planning)?
representation (Letter of Representation) from management

To assess risk (likelihood and effect of adverse events) and internal

Key focus of Phase 2
3 controls, often relying on a risk-based audit approach to decide on
(Risk Assessment)?
compliance or substantive testing
.

To obtain sufficient, reliable, and relevant audit evidence through

Key focus of Phase 3
4 inspection, observation, inquiry, confirmation, and re-computation of
(Performance)?
calculations, while maintaining an internal review process

To produce a report identifying the organization, stating the scope,

Key focus of Phase 4
5 objectives, findings, conclusions, recommendations, and providing
(Reporting)?
audit evidence

--------------------------------------------------------------------------------

Question 10: What is the basic role of Information System Auditor? What are the ethical issues
associated with information systems?

Layman Summary: (Basic role defined in Q5). Information systems introduce complex ethical
problems because they centralize data and power. Key ethical issues include: who owns the data
(Information Rights), how digital assets are protected (Property Rights), who is responsible
when systems fail (Accountability), what standards of reliability should be demanded (System
Quality), and how technology affects society and culture (Quality of Life).

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

To evaluate whether adequate controls are present within project

What is the basic
management and business processes, and to validate the effectiveness
1 role of an IS
of those controls, ensuring protection and proper use of Information
Auditor?
System assets

What information rights do individuals and organizations possess

Ethical Issue: Information
2 about themselves, and what obligations do they have concerning
Rights and Obligations
this information?

Ethical Issue: How will traditional intellectual property rights be protected in a digital
3
Property Rights society where tracing ownership and ignoring rights is easy?
.

Ethical Issue: Accountability Who can and will be held accountable and liable for the harm
4
and Control done to information and property rights?

Ethical Issue: System What standards of data and system quality should be demanded to
5 Quality and Quality of protect individual rights? What values and institutions should be
Life preserved in an information society?

--------------------------------------------------------------------------------

Question 11: Discuss the role of auditing in control process.

Layman Summary: The auditor's role is to ensure that the controls implemented by the
organization are actually effective. This requires the auditor to fully understand all the control
points in the system (from physical access to organizational structure and individual
applications). They test these controls by tracing transactions, using automated software,
interviewing personnel, and inspecting relevant documents and logs.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

What is the objective of an MIS To identify all controls that govern individual
1
audit regarding controls? information systems and assess their effectiveness

Thorough understanding of operations, physical facilities,

What knowledge must
telecommunications, control systems, data security objectives,
2 the auditor acquire to
organizational structure, personnel, manual procedures, and
audit controls?
individual applications

How does the Interviewing key individuals, examining application controls, tracing the
3 auditor test the flow of sample transactions through the system, and performing tests
controls? using automated audit software

--------------------------------------------------------------------------------
Question 12: Explain the role of information security administrator.

Layman Summary: The Security Administrator is the chief safety officer for the IT environment.
Their job is to set security policies (subject to board approval), classify data to ensure proper
protection, monitor compliance, investigate all security violations, provide training to staff on
security measures, and advise senior management on overall information resource control.
They are responsible for the continuous security program.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Sets policy (subject to board approval); investigates,

What are the Security
monitors, and counsels management on security matters;
1 Administrator's core policy
and advises senior management on matters of
and management duties?
information resource control

How does the Security Responsible for establishing minimal fixed requirements for
2 Administrator manage data classification of information based on physical, procedural,
and access? and logical security elements

Guides other security administrators and users on the selection

What is the training and
3 and application of security measures, and investigates all security
enforcement role?
violations

What ongoing program is the Conducting a security program, which is a series of

4 Security Administrator responsible ongoing, regular, periodic evaluations of the facilities
for? available

--------------------------------------------------------------------------------

Question 13: Discuss CAAT and benefits of CAAT in IS audit.

Layman Summary: (Already summarized in Q1).

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

 An auditing method that uses computer software tools to
Define CAAT (Computer
1 query business data to produce reports that will enhance
Assisted Audit Technique).
an audit

. It simplifies or automates the data analysis and audit process

What is the Time/Efficiency Manual audit tasks that took many man-hours can be
2
benefit of CAAT? done in a fraction of the time

What is the Reliability Enables the auditor to independently create reports that meet their
3
benefit of CAAT? requirements and are a true reflection of the company’s health

What is the Depth A well-designed CAAT audit reviews 100% of all transactions
4
benefit of CAAT? (complete review) instead of relying on sampling

--------------------------------------------------------------------------------

Question 14: Explain about the roles of Information System Auditor.

Layman Summary: (Also covered in Q5 and Q10). The IS auditor’s role is to ensure all aspects of
the system are robust and compliant. This includes verifying IT security, ensuring system
development follows procedures, checking that modifications are authorized, confirming data
processing accuracy, and guaranteeing that identified system issues (bugs) are handled
according to the prescribed process.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

To ensure securities of Information Technology are met and data is

Role 1: Security and
protected from intruders. To verify the System Development or
1 Development
acquisition processes are in accordance with management’s
Process.
general procedures

.
 Role 2: Modifications and To ensure modifications have permissions from the
2
Processing Accuracy. authorities. To ensure data processing is accurate

Role 3: Issue To ensure bugs identified and handled according to the prescribed
3
Handling. process

--------------------------------------------------------------------------------

Question 15: Explain information system audit process.

Layman Summary: This process outlines the specific investigative steps of the audit, which
focuses on where abuse is most likely to happen. The auditor first measures which applications
are most vulnerable, then identifies the potential human sources of threat (e.g., programmers,
users), pinpoints high-risk events where the system could be penetrated (e.g., when data is
altered), and finally conducts the audit check on those vulnerable applications and high-risk
points.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Step 1: Measuring Identification of the vulnerability of each application. High

1 vulnerability of probability of computer abuse (based on application nature
information system. and controls) requires greater need for audit

Identifying the people who might pose a threat to the IS (e.g.,

Step 2: Identification of
2 system analysts, programmers, data entry operators, users,
sources of threat.
vendors, etc.)

Identifying the occasions, points or events when the information

Step 3: Identification
3 system may be penetrated (e.g., when a transaction is added, altered
of high risk points.
or deleted, or when a file is changed)

4 Step 4: Check for Conducting the audit of high-risk potential points, considering the
computer abuse. activities of the people who could abuse the IS for the applications that
 are highly vulnerable

--------------------------------------------------------------------------------

Question 16: How important is auditing during system development process? Outline some of
the activities of audit or in this regard.

Layman Summary: Auditing is critical during system development because catching and fixing
flaws early is far cheaper and easier than trying to repair a complete, live system. The auditor
works as an assurance provider, ensuring the system meets business objectives, adheres to
standards, and facilitating clear communication among all stakeholders.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Finding early and fixing early is always preferable, as it is

Why is auditing during
increasingly difficult and costly to rectify flaws deeper into the
1 system development
developmental stage. It ensures the system is developed as per
important?
objective and requirements

Should interact with each of the stake holders of the system.

Auditor Activity:
Should try to identify and validate the business problems and
2 Stakeholder and
needs and match them with the system design & development
Requirements.
process

Should be able to suggest necessary changes to the system

Auditor Activity: System
3 prototype or module. Should check whether standards are being
Quality and Compliance.
followed properly

--------------------------------------------------------------------------------

Question 17: Describe the role of IS auditor with respect to Physical access controls
Environmental controls.

Layman Summary: The auditor checks controls in two areas. For Physical Access, they ensure
that only authorized personnel can access IT assets by reviewing access logs, procedures, and
touring facilities. For Environmental Controls, they focus on physical safety risks (fire, water,
power) by reviewing policy, checking building plans, inspecting fire equipment, verifying backup
power systems, and observing activities in the Information Processing Facilities (IPF) to confirm
safety practices.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Reviews controls by touring organizational facilities

Role in Physical Access
1 (including offsite ones), inspecting core computing
Controls (Review/Inspection)
facilities, and reviewing physical access logs

Reviews procedures such as user registration, authorization for

Role in Physical
special access, logging, and particularly employee termination
2 Access Controls
procedures (e.g., withdrawal of physical devices, deactivation of
(Procedures)
access rights)

Ensures the risk profile includes natural and man-made

Role in Environmental
3 environmental risks. Reviews security policy, building plans, and
Controls (Planning/Policy)
wiring plans to assess the appropriateness of the IPF location

Verifies the presence and working condition of water & smoke

Role in Environmental
detectors. Checks the location and refilling dates of firefighting
4 Controls
equipment. Conducts tests on power sources (e.g., quality of
(Verification/Testing)
power, effectiveness of power conditioning equipment)

--------------------------------------------------------------------------------

Question 18: Describe the major techniques of concurrent audit.

Layman Summary: Concurrent auditing involves running audit tests while the system is
processing live data. Techniques differ in how they interact with live data: ITF uses fake records
alongside real ones; Snapshot records the system state before and after specific transactions
are processed; SCARF and CIS use permanent embedded modules to continuously monitor
transactions based on predefined criteria; and Audit Hooks flag suspicious transactions instantly
for real-time alerts.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Places a small set of fictitious records in the master file and

Technique: Integrated
1 processes test transactions to update them without affecting
Test Facility (ITF)
actual records

Examines how transactions are processed by marking selected transactions

Technique:
2 with a code, triggering audit modules to record records before and after
Snapshot
processing

Technique: SCARF Uses embedded audit modules to continuously monitor transaction

3 (System control audit activity and collect data on transactions with special audit
review file) significance (e.g., transactions exceeding a specified rupee limit)

Technique: Continuous Embeds an audit module in a DBMS to independently process

4 and Intermitted selected transactions, compare results with DBMS output, and
Simulation (CIS) write discrepancies to an audit log

Audit routines that flag suspicious transactions instantly, allowing auditors

Technique:
5 to be informed of questionable transactions as soon as they occur (e.g., by
Audit Hooks
displaying a message on the auditor’s terminal)

--------------------------------------------------------------------------------

Question 19: Explain the inherent limitations of audit.

Layman Summary: Audits cannot provide 100% assurance due to intrinsic constraints. These
constraints include the need to follow specific financial reporting rules, the inherent limitations
of the audit procedures themselves, and the necessity to complete the audit within a
reasonable timeframe and cost. Due to these limits, audits may not uncover complex issues like
fraud involving senior management, collusion, or events that threaten the company’s future
viability.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

List three constraints The nature of financial reporting; the nature of audit
1 that cause audit procedures; and the need for the audit to be conducted within a
limitations. reasonable period of time and at a reasonable cost

Fraud, particularly that involving senior management or collusion;

What types of serious
the existence and completeness of related party relationships and
2 issues might an audit
transactions; and the occurrence of non-compliance with laws
inherently fail to detect?
and regulations

What temporal issue is considered Future events or conditions that may cause an entity to
3
an inherent limitation? cease to continue as a going concern

--------------------------------------------------------------------------------

Question 20: Write short note on Audit Trail.

Layman Summary: An audit trail is a log that chronologically records activity at the system,
application, and user level. It serves as an essential detective control. It has two components:
the Accounting Audit Trail (which tracks data source and updates to the database) and the
Operations Audit Trail (which records resource consumption). It is necessary to answer queries,
meet legal requirements, and allow system monitoring.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

What is an Logs that record activity at the system, application, and user level. It is an
1
Audit Trail? important detective control to help accomplish security policy objectives

2 What two types of Accounting audit trail (shows the source and nature of data and
trails does it processes that update the database) and Operations audit trail
 include? (maintains a record of attempted or actual resource consumption)

What is the purpose To ensure a chronological record of all events is maintained, needed to
3 of audit trail answer queries, fulfill statutory requirements, detect errors, and allow
controls? system monitoring and tuning

--------------------------------------------------------------------------------

Question 21: Explain three major ways by which audit trails can be used to support security
objectives.

Layman Summary: Audit trails help security in three ways. 1. Detection: They can spot
unauthorized access in real-time or after the fact. 2. Reconstruction: They allow analysts to
rebuild the sequence of events leading up to a system failure or security breach, aiding in
recovery. 3. Accountability: They record user activity, which acts as a deterrent (preventive
control) because employees know their actions are logged.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Security Support: Detection can occur in real time (to protect against system
1 Detecting Unauthorized breaches) or after the fact (to determine if unauthorized
Access. access was attempted or accomplished)

Used to reconstruct the steps that led to system failures, security

Security Support:
2 violations, or application processing errors, helping to assign
Reconstructing Events.
responsibility and avoid similar situations in the future

They monitor user activity, acting as a preventive control because

Security Support:
3 individuals are less likely to violate policy if they know their actions
Personal Accountability.
are being recorded in an audit log

--------------------------------------------------------------------------------
Question 22: While doing audit or self-assessment of the BCM program of an enterprise, briefly
describe the matters to be verified.

Layman Summary: When auditing the Business Continuity Management (BCM) program, the
auditor must ensure that the plan is comprehensive, accurate, and practiced. Verification
includes checking that all critical activities are identified, the policies match corporate priorities,
staff competence is adequate, recovery solutions are up-to-date, and there are ongoing
programs for training, maintenance, and handling changes.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Verify that all key products, services, and supporting critical

BCM Verification:
1 activities and resources have been identified. Verify that the BCM
Criticality and Policy.
policy and strategies accurately reflect enterprise priorities

BCM Verification: Verify the enterprise’s BCM competence and capability are effective
2 Competence and and fit-for-purpose to manage an incident. Verify the BCM solutions
Solutions. are effective, up-to-date, and appropriate to the level of risk faced

BCM Verification: Verify BCM strategies incorporate improvements identified during

3 Maintenance and incidents and exercises. Verify the enterprise has an ongoing
Personnel. program for BCM training and awareness

BCM Verification: Verify BCM procedures have been effectively communicated to

4 Communication and relevant staff and that staff understand their roles. Verify Change
Control. control processes are in place and operate effectively

--------------------------------------------------------------------------------

Question 23: What are the steps to be taken by an IS Auditor with respect to IT in the process of
BCP/DRP Audit?

Layman Summary: For an IT-focused BCP/DRP audit, the auditor ensures the plan is realistic and
covers essential technological requirements. This includes checking that the plan matches the
current IT environment, that critical systems are prioritized with reasonable recovery time
requirements, and that backup communication methods are arranged. Most importantly, the
auditor verifies that a robust testing schedule exists (at least annually) and that any weaknesses
found in previous tests have been corrected.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

Determine if the plan reflects the current IT environment.

BCP/DRP Audit Step 1: Current
1 Determine if the plan includes prioritization of critical
Environment & Prioritization.
applications and systems

Determine if the plan includes time requirements for

BCP/DRP Audit Step 2: recovery/availability of each critical system, and that they are
2 Time and reasonable. Determine if the plan includes arrangements for
Communication. emergency telecommunications and alternate means of data
transmission

Determine if a testing schedule exists and is adequate (at least

BCP/DRP Audit Step 3:
3 annually). Verify the date of the last test. Determine if weakness
Testing and Correction.
identified in the last test were corrected

--------------------------------------------------------------------------------

Question 24: Discuss the various standards for IS Audit.

Layman Summary: ISACA provides a framework for IS Audit standards broken into three tiers.
The highest tier, Standards, defines the mandatory, minimum acceptable performance levels.
The second tier, Guidelines, provides advice on how to comply with those mandatory standards.
The lowest tier, Tools and Techniques (like COBIT or audit programs), offers additional useful
guidance but is not mandatory.

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

1 What is the highest tier Standards: Contain statements of mandatory requirements for IS
of ISACA guidance? audit and assurance. They define the minimum level of
 acceptable performance

May result in an investigation into the CISA holder's conduct

What happens if a CISA holder
2 by the ISACA Board of Directors and, ultimately, in
fails to comply with Standards?
disciplinary action

What is the second Guidelines: Provide guidance and additional information on how to
3 tier of ISACA comply with the mandatory Standards. Professionals should consider
guidance? these when justifying any departure from the standards

Tools and Techniques: Provide additional guidance but do not set

What is the third tier
4 requirements. Examples include COBIT 5 family of products and IS
of ISACA guidance?
audit/assurance programs

--------------------------------------------------------------------------------

Question 25: Discuss the need of internal standards for IT governance.

Layman Summary: International standards (like COBIT or ISO 27001) are necessary for IT
governance because they provide structured procedures and best practices, which increase the
efficiency, reliability, and security of the IT system

. They help IT managers align technology with business goals, reduce the chances of system
breaks, make rectification easier, and ensure regulatory compliance, ultimately boosting the
company’s performance

Flashcards for Quick Revision:

Card Front (Question) Back (Answer)

What is the primary benefit They provide structured procedures, practices, and steps
1 of adopting IT governance that increase the efficiency, reliability, and effectiveness of
standards? the Information System and its governance

.
 They help IT managers bridge the gap between control
How do standards help
requirements, technical issues, and business risks, emphasize
2 with risk and
regulatory compliance, and simplify the implementation of the IT
compliance?
governance framework

What are the practical Reduces the chances of system breaks, makes it easier to identify
3 outcomes of adopting the cause of breaks for rectification, and ensures cost-effective
standards? and secured use of the system

List the six principles that the 1. Responsibility. 2. Strategy. 3. Acquisition. 4. Performance.
4
standard consists of. 5. Conformance. 6. Human behaviour