1 | P a g e
CISA Study Notes CISA Study Notes.
What is the PRIMARY objective of an IS audit? - ANSWERTo provide assurance
that IT controls are adequate, effective, and support business objectives
What should an auditor do FIRST when planning an audit? - ANSWERConduct
a risk assessment to identify high-risk areas
What makes audit evidence sufficient? - ANSWERIt is enough in quantity to
support the auditor's conclusions
What makes audit evidence appropriate? - ANSWERIt is relevant, reliable,
and obtained from a credible source
What is inherent risk? - ANSWERThe risk that exists before any controls are
applied
What is control risk? - ANSWERThe risk that existing controls fail to prevent or
detect a material error
What is detection risk? - ANSWERThe risk that the auditor fails to detect a
material error during the audit
What is the correct order of the audit process? - ANSWERPlanning โ
Fieldwork โ Reporting โ Follow-up
