CMT 446 Jan-Apr 2021 Exam

MAIN EXAMINATION
JANUARY - APRIL 2021 TRIMESTER
FACULTY OF SCIENCE
DEPARTMENT OF COMPUTER AND INFORMATION SCIENCE
REGULAR PROGRAMME
CMT 446: INFORMATION SYSTEMS AUDIT
Date: April 2021 Duration: 2 Hours

Instructions: Answer Question ONE and any other TWO Questions.
a) What do you understand by ‘Information systems auditing? (2 Marks)
b) The framework for the ISACA IS Auditing Standards provides for multiple levels, as follows:
(i) Standards
(ii) Guidelines
(iii) Procedures
Describe each and give at least one example. (6 Marks)
c) What do you understand by the term ‘Audit Charter? (2 Marks)
d) Briefly describe the following risks?
i) Inherent risk (1 Mark)
ii) Detection risk (1 Mark)
iii) Audit risk (1 Mark)
iv) Control risk (1 Mark)

e) Describe how identity theft is used to cause fraud in information systems (2 Marks)
f) One of the Codes of professional ethics states that “Perform their duties with objectivity, due
diligence and professional care, in accordance with professional standards and best practices”.
Describe what is meant by:
i) Objectivity (1 Mark)
ii) Due diligence (1 Mark)
iii) Professional care (1 Mark)
g) The Audit methodology consists of eight steps. List them in their correct order. (5 Marks)
Audit report preparation, Data gathering, Audit scope, Pre-audit planning, Audit objective,
Communication with management, Audit subject, Evaluation of test results
i) At what step in the audit process should specific functions to be examined be identified? (1
Mark)
ii) At what step in the audit process do you identify follow-up review procedures? (1 Mark)
iii) At what step in the audit process do you identify the individuals to be interviewed? (1 Mark)
h) The internal audit department wrote some scripts that are used for continuous auditing of
some information systems. The IT department asked for copies of the scripts so that they can
use them for setting up a continuous monitoring process on key systems. Does sharing this
scripts with IT department affect the ability of the IS auditors to independently and objectively
audit the IT function? Justify your answer. (3 Marks)
QUESTION TWO
(a) (i) Controls are generally categorized into three major classifications. List these three and
give an example of each in relation to information systems environment. (6 Marks)

ii) Which controls should an IS auditor look for in an environment where duties cannot be
appropriately segregated? (2 Marks)
iii) An IS auditor is reviewing security controls for a critical web-based system prior to
implementation. The results of the penetration test are inconclusive, and the results will not be
finalized prior to implementation. What action should the IS auditor take? Justify your answer.
(3 Marks)
(b) Audit planning consists of both short- and long-term planning.
(i) Describe each type mentioned above (2 Marks)
(ii) An IS auditor is developing an audit plan for an environment that includes new systems. The
organization’s management wants the IS auditor to focus on recently implemented systems.
How should the IS auditor respond? Justify your answer. (3 Marks)
(c) What is ‘Evidence’ in relationship to System Auditing? (2 Marks)
(d) An Information system auditor encounters several computer forensic scenarios in the course
of his work. Discuss two common scenarios in the field (2 Marks)
QUESTION THREE
(a) Describe and give an example of each of the following:
i) Contingency planning, (2 Marks)
ii) Incident response, (2 Marks)
iii) Disaster Recovery (2 Marks)
iv) Business Continuity (2 Marks)
(b) With a well labeled diagram, show the relationship of the four elements given above. (4
Marks)
(c) i) The decisions and actions of an IS auditor are MOST likely to affect which type of risk?
(2 Marks)
ii) An IS auditor is conducting a review of software usage and licensing discovers that numerous
PCs contain unauthorized software. What action should the auditor take? (2 Marks)
d) An IS auditor finds a small number of user access requests that had not been authorized by
managers through the normal predefined workflow steps and escalation rules. What action
should the IS auditor take? (2 Marks)
e) Which sampling method is MOST useful when testing for compliance? (2 Marks)
QUESTION FOUR
a) Which control is the BEST way to ensure that data in a file have not been changed during
transmission? (2 Marks)
b) Which information asset protection technique would MOST effectively prevent unauthorized
access to a system administration account on a web server? (2 Marks)
c) An organization IT director has approved the installation of Wireless Local Area Network in a
conference room for a team of consultants to access the internet with their laptop computers.
What is the BEST control to protect the corporate servers from unauthorized access? (2
Marks)
d) An IS auditor is reviewing an organization’s human resources (HR) database implementation.
The auditor discovers that the database servers are clustered for high availability, all default
database accounts have been removed and database audit logs are kept and reviewed on a
weekly basis.
What other area should the auditor check to ensure that the databases are appropriately
secured? (2 Marks)
e) What is the BEST way to minimize unauthorized access to unattended end-user PC
systems? (2 Marks)
f) What would be the BEST defense against the introduction of Trojan horse software into an
organization? (2 Marks)
g) What would be the BEST control to implement in order to mitigate the risk of an insider
attack? (2 Marks)
h) A rigid methodology is used to preserve the chain of custody in evidence handling. Arrange
the following three steps in the correct order. (2 Marks)
Preserve and authenticate, Identify and acquire, Analyze, record, and present
i) What is IT governance? (2 Marks)
j) The vice president of HR has requested an IS audit to identify payroll overpayments for the
previous year. Which would be the BEST audit technique to use in this situation? (2 Marks)
QUESTION FIVE
a) Which software should an IS auditor use to detect duplicate invoice records within an invoice
master file? (2 Marks)
b) Which is the MOST important reason for an IS auditor to obtain sufficient and appropriate
audit evidence? (2 Marks)
c) What is the PRIMARY purpose for meeting with auditees prior to formally closing a review?
(2 Marks)
d) Which audit technique would BEST aid an auditor in determining whether there have been
unauthorized program changes since the last authorized program update? (2 Marks)
e) Describe two functions of an IS steering committee? (2 Marks)
f) Who is responsible for establishing the level of acceptable risk? (2 Marks)
g) Describe one key benefit of control self-assessment (CSA)? (2 Marks)
h) Who makes the final decision to include a material finding in an audit report (2 Marks)
i) Which audit technique would be MOST effective for identifying segregation of duties violations
in a new enterprise resource planning (ERP) implementation? (2 Marks)
j) What is the PRIMARY reason an IS auditor performs a functional walkthrough during the
preliminary phase of an audit assignment? (2 Marks)

CMT 446 Jan-Apr 2021 Exam

Uploaded by

Copyright:

Available Formats

CMT 446 Jan-Apr 2021 Exam

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CMT 446 Jan-Apr 2021 Exam

Uploaded by

Copyright:

Available Formats

MAIN EXAMINATION

JANUARY - APRIL 2021 TRIMESTER

DEPARTMENT OF COMPUTER AND INFORMATION SCIENCE

CMT 446: INFORMATION SYSTEMS AUDIT

Date: April 2021 Duration: 2 Hours

a) What do you understand by ‘Information systems auditing? (2 Marks)

Describe each and give at least one example. (6 Marks)

c) What do you understand by the term ‘Audit Charter? (2 Marks)

d) Briefly describe the following risks?

i) Inherent risk (1 Mark)

ii) Detection risk (1 Mark)

iii) Audit risk (1 Mark)

iv) Control risk (1 Mark)

Describe what is meant by:

ii) Due diligence (1 Mark)

iii) Professional care (1 Mark)

Communication with management, Audit subject, Evaluation of test results

audit the IT function? Justify your answer. (3 Marks)

give an example of each in relation to information systems environment. (6 Marks)

appropriately segregated? (2 Marks)

(b) Audit planning consists of both short- and long-term planning.

(i) Describe each type mentioned above (2 Marks)

organization’s management wants the IS auditor to focus on recently implemented systems.

How should the IS auditor respond? Justify your answer. (3 Marks)

(c) What is ‘Evidence’ in relationship to System Auditing? (2 Marks)

of his work. Discuss two common scenarios in the field (2 Marks)

(a) Describe and give an example of each of the following:

i) Contingency planning, (2 Marks)

ii) Incident response, (2 Marks)

iii) Disaster Recovery (2 Marks)

iv) Business Continuity (2 Marks)

should the IS auditor take? (2 Marks)

access to a system administration account on a web server? (2 Marks)

d) An IS auditor is reviewing an organization’s human resources (HR) database implementation.

e) What is the BEST way to minimize unauthorized access to unattended end-user PC

the following three steps in the correct order. (2 Marks)

i) What is IT governance? (2 Marks)

master file? (2 Marks)

audit evidence? (2 Marks)

e) Describe two functions of an IS steering committee? (2 Marks)

f) Who is responsible for establishing the level of acceptable risk? (2 Marks)

g) Describe one key benefit of control self-assessment (CSA)? (2 Marks)

in a new enterprise resource planning (ERP) implementation? (2 Marks)

preliminary phase of an audit assignment? (2 Marks)

You might also like