CISA practice questions 881–890

1. Question 881 · 1459 in bank

   Which of the following areas of responsibility would cause the GREATEST segregation of duties conflict if the individual who performs the related tasks also has approval authority?

   • AVendor selection and statements of work
   • BInvoices and reconciliations
   • CPurchase requisitions and purchase orders
   • DGoods receipts and payments

   Show answer

   Answer: D

   Explanation

   While Option A represents a segregation of duties concern, Option D presents a greater conflict because it involves both the physical handling of inventory and the financial control over payments, thereby posing a higher risk of fraud or misappropriation. Therefore, Option D is considered to have the GREATEST segregation of duties conflict.

   Source: Adapted from community discussion — KAP2HURUF

   Next question

2. Question 882 · 1459 in bank

   Which of the following would MOST likely impair the independence of the IS auditor when performing a post-implementation review of an application system?

   • AThe IS auditor implemented a specific control during the development of the application system.
   • BThe IS auditor designed an embedded audit module exclusively for auditing the application system.
   • CThe IS auditor participated as a member of the application system project team, but did not have operational responsibilities.
   • DThe IS auditor provided consulting advice concerning application system best practices.

   Show answer

   Answer: A

   Explanation

   C. The IS auditor participated as a member of the application system project team, but did not have operational responsibilities.

   Source: Adapted from community discussion — Changwha

   Next question

3. Question 883 · 1459 in bank

   Which of the following is MOST important for an IS auditor to assess during a post-implementation review of a newly modified IT application developed in-house?

   • ARollback plans for changes
   • BSufficiency of implemented controls
   • CUpdates required for end user manuals
   • DResource management plan

   Show answer

   Answer: B

   Explanation

   While rollback plans for changes (Option A) are important for mitigating risks associated with implementation issues or unforeseen consequences of modifications, the sufficiency of implemented controls is of greater importance during a post-implementation review. Assessing the sufficiency of controls ensures that appropriate measures are in place to manage risks, protect data, maintain system integrity, and ensure compliance with relevant policies, standards, and regulations.

   Source: Adapted from community discussion — Swallows

   Next question

4. Question 884 · 1459 in bank

   During audit fieldwork, an IS auditor learns that employees are allowed to connect their personal devices to company-owned computers. How can the auditor BEST validate that appropriate security controls are in place to prevent data loss?

   • AVerify the data loss prevention (DLP) tool is properly configured by the organization.
   • BReview compliance with data loss and applicable mobile device user acceptance policies.
   • CVerify employees have received appropriate mobile device security awareness training.
   • DConduct a walk-through to view results of an employee plugging in a device to transfer confidential data.

   Show answer

   Answer: B

   Explanation

   The best answer is B. Review data loss and compliance with the applicable mobile device user acceptance policy. reason: Option A only focuses on the configuration of DLP tools without considering employee behavior and policy compliance. Option C. While important, insufficient employee awareness training does not necessarily result in data being lost. Option D, while testing employee responses to data loss, does not fully verify the effectiveness of all security controls.

   Source: Adapted from community discussion — BenHung

   Next question

5. Question 885 · 1459 in bank

   Which of the following is the BEST point in time to conduct a post-implementation review (PIR)?

   • ATo coincide with the annual PIR cycle
   • BImmediately after deployment
   • CAfter a full processing cycle
   • DSix weeks after deployment

   Show answer

   Answer: C

   Explanation

   The BEST point in time to conduct a post-implementation review (PIR) is "After a full processing cycle." This allows the system to be tested in a real-world scenario, and any issues can be addressed in a timely manner.

   Source: Adapted from community discussion — zebree

   Next question

6. Question 886 · 1459 in bank

   In which phase of the internal audit process is contact established with the individuals responsible for the business processes in scope for review?

   • AExecution phase
   • BPlanning phase
   • CSelection phase
   • DFollow-up phase

   Show answer

   Answer: B

   Next question

7. Question 887 · 1459 in bank

   Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization's incident management processes?

   • APrioritization criteria are not defined.
   • BService management standards are not followed.
   • CExpected time to resolve incidents is not specified.
   • DMetrics are not reported to senior management.

   Show answer

   Answer: A

   Next question

8. Question 888 · 1459 in bank

   Which of the following approaches would BEST ensure that data protection controls are embedded into software being developed?

   • AUtilizing a data protection template for user acceptance testing (UAT)
   • BImplementing a quality assurance (QA) process during the development phase
   • CDeriving data protection requirements from key stakeholders
   • DTracking data protection requirements throughout the SDLC

   Show answer

   Answer: D

   Next question

9. Question 889 · 1459 in bank

   Which of the following is MOST important for an IS auditor to do during an exit meeting with an auditee?

   • ASpecify implementation dates for the recommendations.
   • BEnsure that the facts presented in the report are correct.
   • CCommunicate the recommendations to senior management.
   • DRequest input in determining corrective action.

   Show answer

   Answer: C

   Explanation

   B seems correct: The exit interview, conducted at the end of the audit, provides an IS auditor with the opportunity to discuss findings and recommendations with the auditee management. During the exit interview, an IS auditor should: • Ensure that the facts presented in the report are correct and material. • Ensure that the recommendations are realistic and cost-effective and, if not, seek alternatives through negotiation with auditee management. • Recommend implementation dates for agreed-on recommendations.

   Source: Adapted from community discussion — user173681972

   Next question

10. Question 890 · 1459 in bank

    Which of the following should be the PRIMARY role of an internal audit function in the management of identified business risks?

    • AValidating enterprise risk management (ERM)
    • BEstablishing a risk management framework
    • COperating the risk management framework
    • DEstablishing a risk appetite

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISA practice, question 881. 1459 questions available.