The traditional role of an IS auditor in a control self-assessment (CSA) should be that of a facilitator.
Using a statistical sample to inventory the tape library is an example of a substantive test.
Audit responsibility enhancement is an objective of a control self-assessment (CSA) program.
If proper identification and authentication are not performed during access control, no accountability can exist for any action performed.
IS auditors are most likely to perform compliance tests of internal controls if, after their initial evaluation of the controls, they conclude that control risks are within the acceptable limits. Think of it this way: If any reliance is placed on internal controls, that reliance must be validated through compliance testing. High control risk results in little reliance on internal controls, which results in additional substantive testing.
In planning an audit, the most critical step is identifying the areas of high risk.
Prior audit reports are considered of lesser value to an IS auditor attempting to gain an understanding of an organization's IT process than evidence directly collected.
When evaluating the collective effect of preventative, detective, or corrective controls within a process, an IS auditor should be aware of the point at which controls are exercised as data flows through the system.
The primary purpose of audit trails is to establish accountability and responsibility for processed transactions.
When implementing continuous monitoring systems, an IS auditor's first step is to identify high-risk areas within the organization.
Auditing resources are allocated to the areas of highest concern, as a benefit of a risk-based approach to audit planning.
Inherent risk is associated with authorized program exits (trap doors).
After an IS auditor has identified threats and potential impacts, the auditor should identify and evaluate the existing controls.
Generalized audit software can be used to search for address field duplications.
The use of statistical sampling procedures helps minimize detection risk.
Lack of reporting of a successful attack on the network is a great concern to an IS auditor.
Detection risk results when an IS auditor uses an inadequate test procedure and concludes that material errors do not exist when errors actually exist.
An integrated test facility is considered a useful audit tool because it compares processing output with independently calculated data.
