CISAReviewCourse

Chapter1

TheISAuditProcessProcessAreaOverviewIntroductionISACAstandardsandguidelinesforISauditingRiskanalysisInternalcontrolsPerforminganISauditControlselfassessmentEmergingchangesintheISauditprocessProcessAreaObjective

EnsurethattheCISAcandidate…

”HastheknowledgenecessarytoconductISauditsinaccordancewithgenerally-acceptedinformationsystemsauditstandardsandauditguidelinestoprovideastatementofassurancethattheorganization’sITandbusinesssystemsareadequatelycontrolled,monitoredandassessed"ProcessAreaSummary

AccordingtotheCertificationBoard,

thisProcessAreawillrepresentapproximately

10%

oftheCISAexamination

(approximately20questions).1.1IntroductionOrganizationoftheISAuditFunctionISAuditResourceManagementAuditPlanningShortandlongtermplanningIndividualassignmentplanningLawsandRegulations1.1IntroductionOrganizationoftheISAuditFunctionAuditCharter1.1IntroductionAuditResourceManagementISauditorsarelimitedresourcesAppropriateskillsandknowledgeConstraintsontheconductoftheauditProjectmanagementtechniques1.1IntroductionAuditPlanningAdequateplanningisanecessaryfirststepinperformingeffectiveITAuditsNeedtounderstandthegeneralbusinessenvironmentaswellastheassociatedbusinessandcontrolrisksAssessoperationalandcontrolrisksandidentifycontrolobjectivesduringauditplanning1.1IntroductionLawsandRegulationsRegulatoryrequirementsEstablishmentOrganization ResponsibilitiesCorrelationtofinancialand operationalauditfunctions1.1IntroductionLawsandRegulationsStepstodetermineanorganization’slevelofcompliancewithexternalrequirements:IdentifygovernmentorotherrelevantexternalrequirementsDocumentpertinentlawsandregulationsAssesswhetherthemanagementoftheorganizationandtheinformationsystemsfunctionhaveconsideredtherelevantexternalrequirementsinmakingplansandinsettingpolicies,standardsandprocedures.Reviewinternalinformationsystemsdepartment/function/activitydocumentsthataddressadherencetolawsapplicabletotheindustry.Determineadherencetoestablishedproceduresthataddresstheserequirements.1.2ISACAStandardsandGuidelinesforISAuditingISACACodeofProfessionalEthicsISACAStandardsforISAuditingISACAGuidelinesforISAuditing1.2ISACAStandardsandGuidelinesforISAuditing

TheAssociation’sCodeofProfessionalEthicsprovidesguidancefortheprofessionalandpersonalconductofmembersoftheAssociationand/orholdersoftheCISAdesignation.ISACACodeofProfessionalEthics1.2ISACAStandardsandGuidelinesforISAuditingInformISauditorsoftheminimumlevelofacceptableperformancerequiredtomeetprofessionalresponsibilitiessetoutintheISACACodeofProfessionalEthics.Informmanagementandotherinterestedpartiesoftheprofession’sexpectationsconcerningtheworkofpractitioners.

ObjectivesforISACA’sStandards1.2ISACAStandardsandGuidelinesforISAuditingStandardsGuidelinesProceduresFrameworkfortheISACA’sInformationSystemsAuditingStandards:1.2ISACAStandardsandGuidelinesforISAuditingS1-Auditcharter S2-IndependenceS3-ProfessionalEthicsandStandardsS4-Competence

ThestandardsapplicabletoISauditingare:1.2ISACAStandardsandGuidelinesforISAuditing

S5-PlanningS6-PerformanceofAuditWorkS7-ReportingS8-Follow-upactivities

ThestandardsapplicabletoISauditingare:Continued...1.2ISACAStandardsandGuidelinesforISAuditing

S9-IrregularitiesandIllegalActsS10-ITgovernanceS11-UseofRiskAssessmentinAuditPlanning

ThestandardsapplicabletoISauditingare:Continued...1.2ISACAStandardsandGuidelinesforISAuditingS1-AuditCharterResponsibility,AuthorityandAccountability1.2ISACAStandardsandGuidelinesforISAuditingS2-IndependenceProfessionalIndependenceOrganizationalRelationship1.2ISACAStandardsandGuidelinesforISAuditingS3-ProfessionalEthicsandStandardsCodeofProfessionalEthicsDueProfessionalCare1.2ISACAStandardsandGuidelinesforISAuditingS4-CompetenceSkillsandKnowledgeContinuingProfessionalEducation1.2ISACAStandardsandGuidelinesforISAuditing

S5-PlanningAuditPlanning1.2ISACAStandardsandGuidelinesforISAuditingS6-PerformanceofAuditWorkSupervisionEvidence1.2ISACAStandardsandGuidelinesforISAuditingS7-ReportingReportContentandForm1.2ISACAStandardsandGuidelinesforISAuditingS8-Follow-upActivitiesReviewpreviousrelevantfindingsReviewpreviousconclusionsandmendations1.2ISACAStandardsandGuidelinesforISAuditingS9-IrregularitiesandIllegalActs

1.2ISACAStandardsandGuidelinesforISAuditingS10-ITgovernance

1.2ISACAStandardsandGuidelinesforISAuditingS11-UseofRiskAssessmentinAuditPlanning

1.2ISACAStandardsandGuidelinesforISAuditingConsidertheguidelinesindetermininghowtoimplementtheabovementionedstandards.Useprofessionaljudgementinapplyingthem.Beabletojustifyanydeparture.

TheISauditorshould:1.3RiskAnalysis

“Thepotentialthatagiventhreatwillexploitvulnerabilitiesofanassetorgroupofassetstocauselossordamagetotheassets.Theimpactorrelativeseverityoftheriskisproportionaltothebusinessvalueoftheloss/damageandtotheestimatedfrequencyofthethreat.”1.3RiskAnalysisThreatsto,andvulnerabilitiesof,processesand/orassets(includingbothphysicalandinformationassets)ImpactonassetsbasedonthreatsandvulnerabilitiesProbabilitiesofthreats(combinationofthelikelihoodandfrequencyofoccurrence)1.4InternalControlsDefinitionofInternalControlInternalcontrolisaprocessputinplacebytheboardofdirectors,seniormanagementandalllevelsofpersonneltoprovidereasonableassurancethatanorganization'sobjectiveswillbeachieved.1.4InternalControlsControlsPreventiveDetectiveCorrective1.4InternalControlsInternalControlObjectivesISControlObjectivesCobiTGeneralControlProceduresISControlProceduresControlClassifications1.4InternalControlsInternalControlObjectivesInternalcontrolsystemcomponentsInternalaccountingcontrolsOperationalcontrolsAdministrativecontrolsRelevantissues1.4InternalControlsISControlObjectives1.4InternalControlsCOBITITcontrolobjectivesandstandardsofgoodpractice34high-levelcontrolobjectivesExamples1.4InternalControlsGeneralControlProcedures1.4InternalControlsISControlProceduresControlproceduresincludepoliciesandpracticesestablishedbymanagementtoprovidereasonableassurancethatspecificobjectiveswillbeachieved1.4InternalControlsISControlProcedurescanbecategorizedintothefollowingareas:GeneralorganizationcontrolproceduresAccesstodataandprogramsSystemdevelopmentmethodologiesDataprocessingoperationsSystemsprogrammingandtechnicalsupportfunctionsDataprocessingqualityassuranceprocedures1.5PerforminganISAudit

DefinitionofauditingSystematicprocessbywhichacompetent,independentpersonobjectivelyobtainsandevaluatesevidenceregardingassertionsaboutaneconomicentityoreventforthepurposeofforminganopinionaboutandreportingonthedegreetowhichtheassertionconformstoanidentifiedsetofstandards.

1.5PerforminganISAudit

Classificationofaudits:FinancialAuditsOperationalAuditsIntegratedAuditsAdministrativeAuditsInformationSystemsAudits1.5PerforminganISAudit

DefinitionofISauditing

ISauditingistheprocessofcollectingandevaluatingevidencetodeterminewhetherinformationsystemsandITenvironmentsadequatelysafeguardassets,maintaindataandsystemintegrity,providerelevantandreliableinformation,achieveorganizationalgoalseffectively,consumeresourcesefficiently,andhaveineffectinternalcontrolsthatprovidereasonableassurancethatoperationalandcontrolobjectiveswillbemet.1.5PerforminganISAuditGeneralAuditProceduresObtainingandrecordinganunderstandingofauditarea/subjectRiskassessmentandgeneralauditplanDetailedauditplanningPreliminaryreviewofauditarea/subjectEvaluatingauditarea/subjectCompliancetesting(testofcontrols)SubstantivetestingReportingFollow-up1.5PerforminganISAuditControlobjectivesAuditObjectivesDifferencebetweencontrolandauditobjectives1.5PerforminganISAuditAuditMethodology/StrategyStatementofscopeStatementofauditobjectivesStatementofworkprogramTypicalAuditPhases1.5PerforminganISAuditMateriality-anexpressionoftherelativesignificanceorimportanceofaparticularmatterinthecontextoftheorganisationasawhole.重要性-是指被審計單位會計報表中錯報或漏報的嚴重程度，這一程度在特定環(huán)境下可能影響會計報表使用者的判斷或決策。思考題在一次財務審計中,重要性水平確定為100000元,因此,余額小于100000元以下的賬戶不用檢查.1.5PerforminganISAuditRisk-basedapproachFocusesonthebusinessfromamanagementperspectiveEmphasisonknowledgeofthebusinessandtechnologyFocusesonassessingtheeffectivenessofa“combination”ofcontrolsLinkagebetweenriskassessmentandtestingfocusingoncontrolobjectives.1.5PerforminganISAudit

Auditriskcanbecategorizedas:

InherentRiskControlRiskDetectionRiskOverallAuditRiskRiskAssessmentTechniquesEnablesmanagementtoeffectivelyallocatelimitedauditresources.Ensuresthatrelevantinformationhasbeenobtained.Establishesabasisforeffectivelymanagingtheauditdepartment.Providesasummaryofhowtheindividualauditsubjectisrelatedtotheoverallorganizationandtobusinessplans.1.5PerforminganISAudit1.5PerforminganISAuditRelationshipbetweenSubstantiveandCompliancetestsCorrelationbetweenthelevelofinternalcontrolsandSubstantiveTestingRequired1.5PerforminganISAudit

Evidence–Itisarequirementthattheauditor’sconclusionsmustbebasedonsufficient,competentevidence.IndependenceoftheprovideroftheevidenceQualificationoftheindividualprovidingtheinformationorevidenceObjectivityoftheevidence1.5PerforminganISAuditTechniquesforgatheringevidence:ReviewISorganizationstructuresReviewISpolicies,proceduresandstandardsReviewISdocumentationInterviewappropriatepersonnelObserveprocessesandemployeeperformance.1.5PerforminganISAuditSamplingGeneralapproachestoauditsampling:StatisticalsamplingNon-statisticalsamplingMethodsofSamplingusedbyauditors:AttributesamplingVariablesampling1.5PerforminganISAuditSampling(Continued…)AttributesamplingAttributesamplingStop-or-gosamplingDiscoverysamplingVariableSampling:StratifiedmeanperunitUnstratifiedmeanperunitDifferenceestimationStatisticalsamplingterms:ConfidentcoefficientLevelofriskPrecisionExpectederrorrateSamplemeanSamplestandarddeviationTolerableerrorratePopulationstandarddeviationKeystepsinchoosingasample1.5PerforminganISAuditComputer-assistedAuditTechniquesCAATSareasignificanttoolsforISauditorstogatherinformationindependently.Includes:Generalizedauditsoftware(ACL,IDEA,etc.)UtilitysoftwareTestdataApplicationsoftwareforcontinuousonlineauditsAuditexpertsystems1.5PerforminganISAuditComputer-assistedAuditTechniquesNeedforCAATsEvidencecollectionFunctionalCapabilitiesFunctionssupportedAreasofconcern1.5PerforminganISAuditComputer-assistedAuditTechniquesExamplesofCAATsusedtocollectevidenceContinuousOnlineAuditApproach1.5PerforminganISAuditComputer-AssistedAuditTechniquesAdvantagesofCAATsCost/benefitsofCAATs1.5PerforminganISAuditComputer-assistedAuditTechniquesDevelopmentofCAATsDocumentationretentionAccesstoproductiondataDatamanipulation1.5PerforminganISAuditEvaluationofstrengthsandweaknessesAssesevidenceEvaluateoverallcontrolstructureEvaluatecontrolobjectivesAssesscontrolstrengthenandweaknesses

1.5PerforminganISAuditJudgingMaterialityofFindingsMaterialityisakeyissueAssessmentrequiresjudgmentofthepotentialeffectofthefindingifcorrectiveactionisnottaken.1.5PerforminganISAudit

CommunicatingAuditResultsAuditreportstructureandcontentsExitinterviewPresentationtechniquesExecutivesummaryVisualpresentation1.5PerforminganISAudit1.5PerforminganISAuditManagementActionstoImplementmendationsAuditingisanongoingprocessTimingoffollow-upAuditDocumentationConstrainsontheConductoftheAuditProjectManagementTechniquesDevelopadetailedplanReportprojectactivityagainsttheplanAdjusttheplanandtakecorrectiveaction,asrequired1.5.17AuditDocumentation1.6ControlSelf-AssessmentBenefitsofCSADisadvantagesofCSAAuditorRoleinCSATechnologyDriversforCSATraditionalvs.CSAApproach1.7EmergingChangesintheISAuditProcessAutomatedWorkPapersIntegratedAuditingContinuousAuditing1.8 Chapter1CaseStudy1.8.1CaseStudyScenario

1.8.2CaseStudyQuestions

Chapter1:GlossaryAdministrativecontrolsAttributesamplingAuditriskCompliancetestingCAATControlriskEmbeddedauditmodulesMaterialityChapter1:Questions1.AnISauditor,performingareviewofanapplication’scontrols,discoversaweaknessinsystemsoftware,whichcouldmateriallyimpacttheapplication.TheISauditorshould:A.ignorethesecontrolweaknessesasasystemsoftwarereviewisbeyondthescopeofthisreview.B.conductadetailedsystemsoftwarereviewandreportthecontrolweaknesses.C.includeinthereportastatementthattheauditwaslimitedtoareviewoftheapplication’scontrols.D.reviewthesystemsoftwarecontrolsasrelevantandmendadetailedsystemsoftwarereview.Chapter1:Questions2.AnISauditor’sindependencewouldMOSTlikelybequestionedif:A.theclienthasagreedtothescopeoftheaudit.B.ISmanagementhashadinputintotheschedulingoftheaudit.C.theclientwillhavefinalauthorityonthecontentsoftheauditreport.D.theaudithasbeenrequestedbythemanagementoftheareatotheaudited.Chapter1:Questions3.WhichofthefollowingistheMOSTappropriateauditevaluationtechniquetoprovideassurancethatadequatedatabackupsexisttoallowtimelyrecoveryofsystemoperationsfollowingservicedisruptions?A.Stop-or-gosamplingB.InterviewpersonnelandreviewinformationsystemsorganizationstructureC.ReviewapplicabledocumentedproceduresandobservetheprocessD.UseanyautomatedtoolChapter1:Questions4.TheISdepartmenthasbeenrequestedbyexecutivemanagementtoreviewsystemsoftwareaccesscontrols.TheISauditdepartmentdoesnothaveonstaffanyonewithknowledgeinthisarea.Theyshould:A.performtheauditandacknowledgeinthereportalackofexpertise.B.conducttheauditwiththeassistanceofthesystemsoftwaremanager.C.obtaintraininginsystemsoftwareandthenperformtheaudit.D.conducttheassignmentbylearningon-the-job.Chapter1:Questions5.Theobjectiveof