Audit Risk and Relationship

This post is in relation to a question asked by a reader

Question:

Jez4christ has left a new comment on your post "Audit Risk Assessment – Risk Types & Relationships...":

Hi,

I am reading your blog to prepare for the CISA exam in addition to the CRM.

Have a question: you mentioned "Inherent Risk × Control Risk = Residual Risk
".

How does the "x"- "multiply by" be explained?

Am still stuck in the "Residual risk = Total Risk - Responses to Risks"

Thanks,
James Tan



Answer:

I. Your First Doubt

you mentioned "Inherent Risk × Control Risk = Residual Risk
".

How does the "x"- "multiply by" be explained?

A good observation!

Before Explaining relationship between Inherent Risk,Control Risk and Residual Risk let us once more see what these terms denote.

Inherent risk =1

is the default risk linked to the area of audit. In other words Inherent risk is the risk naturally related to the business area of audit subject.

Control Risk =2

is the risk originated because of errors or irregularities in the audit subject may not be detected, prevented or corrected by existing internal control.

Now the question is what should be the residual risk.

Is it 1 less 2 ?

No, but if you have to take X as minus sign then my explanation for residual risk will be :

The risk linked to the audit area (i) , less the amount of error detected by controls(ii) =
The amount of error likely to remain unnoticed(iii).

Here i is Inherent Risk & iii is Residual Risk

Now my question would be

if 2=(ii) ?

&

is ii= control risk?

II. Your second doubt

Am still stuck in the "Residual risk = Total Risk - Responses to Risks"

the quantity left over at the end of audit process i.e. the remainder is the residual risk.
Explanation for I will answer here as well.

Remember Exam like CISA may not ask the formula but understanding the concept is very much recommended.

Read More......

How to select a CAAT

CAAT stands for Computer Assisted Audit Techniques


This is a common thing of discussion among IS Auditors is "which one is best - CAATs or Manual method of IS Audit". Sometimes manual method is not enough to find out effective and efficient IS Audit results. On the other hand in many instances use of CAATs gives less efficient results than corresponding manual IS Audit methods.

It is always recommended to use a mix of CAATs and manual method for optimal results.

"What should be the criteria to select CAATs?" is another question many IS Auditors ask.

Following are some of the important points an Organization should see before selecting CAATs.

1.End User of CAAT

End user of CAAT/IS Auditors should be able to handle almost all operational and related aspects of the CAAT.

2.Cost Benefit analysis

Cost benefit analysis over similar manual process should be analysed. Cost of control should never be much more than the loss due to risks.

3.System Impact analysis.

This is particularly useful for the CAAT that is integrated to main system. Use of CAAT should never degrade the system performance beyond a certain limit.

4.Compatibility of CAAT

CAAT should ideally be compatible in all hardwares/softwares and available infrastructure.

5.Efficiency, Accuracy & Speed of results

This is the most important aspect of CAAT selection. An efficient, accurate and speedy results producing CAATs are generally preferred.

6.Support from the CAAT vendor

This is equally important criteria for CAAT selection.

7.Limitations and Inherent risks within CAAT.

This should be confirmed and evaluated at the time of decision making for CAAT selection.

8.Security of data processed by CAAT

An important criteria which should be evaluated by Information Security Administrator.

9.Validity Tests

Results of the CAATs should be validated as against corresponding processes. A wide variety of test and live data should be evaluated.

Be careful while analyzing test CAAT data in live environment for validity of CAAT results. Make necessary arrangements to separate test data in live environment.

10.Regulatory and legal requirement (if any)

Do consider regulatory and legal requirements wherever applicable.

Read More......

Control Self-Assessment (CSA)- How,what & why ?

Control Self-Assessment (CSA) is a technique by which an organization accesses & assesses the effectiveness, reliability and adequacy of existing internal controls which may help the organization in strengthening existing controls further.

What can be detected by CSA ?

CSA may help in finding

1.Internal Controls
2.Business & Operation Risks
3.Effectiveness of Controls
4.Reliability & Adequacy of controls

What are the benefits of CSA?

1.Optimization of resources
2.help in risk mitigation
3.Speedy audit


Procedure for conducting CSA

Followings are the steps needed for CSA

1.Questionnaires are sent to previously identified user.
2.Users complete the questions and send the answers to internal audit team.
3.Questionnaires are evaluated.
4.Risk & efficacy for various internal controls are determined.


How CSA is different from other types of audit?

CSA can identify areas of higher risks earlier which may be thoroughly reviewed later

What CSA can not do?

CSA can not take or replace the traditional or formal audit of the organization

Read More......

Audit Risk Assessment – Risk Types & Relationships

Risk assessment is one of the most important part of IS Audit process. This article intends to tell you in brief about different types of audit risks and their interrelationships.

Audit Risk is the risk originated because of auditor's inappropriate or inaccurate judgment about the audit subject or audit area.

In IS Audit process following types of risk can be found:

1.Inherent Risk
2.Control Risk
3.Detection Risk
4.Residual Risk


Inherent Risk is the default risk linked to the area of audit. In other words Inherent risk is the risk naturally related to the business area of audit subject.


Control Risk is the risk originated because of errors or irregularities in the audit subject may not be detected, prevented or corrected by existing internal control.

Remember Control Risk & Internal Control are entirely different.

The risk because the material errors/irregularities in the audit subject will not be detected by substantive test techniques used by IS Auditor is called Detection Risk.

The following formula tells the relationship between all the risk types covered so far.

Audit Risk = Inherent Risk + Control Risk+ Detection Risk

Residual Risk are those risks which exist in the system even after putting controls to mitigate inherent risks of the audit subject.

The relationship between Inherent Risk, Control Risk and Residual Risk can be depicted by the following formula:

Inherent Risk × Control Risk = Residual Risk

Abbreviations used:

IS - Information Systems

Read More......

Corrective Control – Control to correct Information System's detected irregularities

Corrective Controls are one of the three basic types of internal control which are basically meant to correct detected irregularities of Information System.

Success of corrective control (any type of internal control) depends mainly upon the following factors:

1. Control Objective definition
2. Control Rule sets
3. Management support
4. Division of labour and segregation of duties
5. Independence
6. Cost of control versus benefit analysis
7. Skill sets and Techniques


All Controls only provide a reasonable assurance that control objectives will be fulfilled. The corrective controls ensure correctness after detection of errors or irregularities but it does not guarantee the detection of all irregularities.


Example(s) of Corrective control-: Backup System or backup Procedure

Read More......

Use of Sequence Check as a CAAT tool

Sequence Check is an important CAAT tool which is mainly used in:

1. Validation Control

2. Processing Control

This a way by which w ensure whether a set of data is :

1. properly ordered or sequenced or out of ordered

2. within a predefined limit or range or out of predefined range

Ascending or descending sequence of data is verified by means of defined Key field. Key field is also known as Control field or Control number. By predefined key field the validity of a batch is also verified.

Summary:

1. Sequence check is a good CAAT tool.

2.It verifies redundant value ,out of range and out of order value.

3. This ensures validation or processing control.

4. It sometimes acts as input control by checking sequence of incoming records.

5. It sometimes act as a batch control by checking the key field of the batch.

Abbreviation used:

CAAT: Computer Assisted Audit Technique

Read More......

Importance of follow up IS Audit

Follow up IS Audit is very important, sometimes even more important than main IS Audit.Let us briefly discuss what is follow up IS Audit and How this is useful ?

What is follow up IS Audit?

IS Audit which is done after main audit to review the steps taken by Management as suggested/recommended in Main IS Audit.IS Auditors checks whether the critical/major findings as suggested in Main audit is complied
1. Suitably
2. Adequately
3. As recommended or as per the best practice.


Who does the follow up IS Audit?

Not always necessary but this is generally done by same team of IS Auditor which conducts the main IS audit.

What is the purpose of Follow up IS Audit?

1. It reviews whether the management has taken

suitable and adequate

steps to complythe necessary remarks which were not rectified during main audit.

2. Whether all the necessary rectification were made

3. If recommended measures were not taken then why?

4. What is the reason for pending compliance.


Should all the suggested remarks should be rectified and complied?

It depends on:

1. Management appetite for taking risk
2. Cost benefit ratio

Whether IS auditor should submit the report of follow up audit?

Yes this should be as per ISACA Standard and guidelines.


CISA Type Question 08- 2307

When an IS Auditor should go for follow up IS Audit

1. after two weeks of main IS audit
2. after one month of main audit
3. As per the audit charter/engagement letter
4. IS auditor is not responsible for follow audit in any case.




Answer to CISA Type Question 08-2107


When data is bulky we should choose a method which is faster so, preferred method will be Symmetric cryptography as it much faster than asymmetric cryptography. So, the correct answer should be 1. Symmetric Cryptography

Read More......

Important types of Sampling for CISA Exam

CISA Quick Point 17

Sampling could be of many types. For the preparation of CISA Exam you should know the the types of sampling (I think indepth knowledge about each is not always needed. the basics should do)

Important types of sampling are

1. Simple Random sampling
2. Stratified Random Sampling
3. Multistage Cluster Sampling
4. Purposive sampling.

Simple Random sampling, Stratified Random Sampling &  Multistage Cluster Sampling are the types of
Probability Sampling/Mathematical sampling/Statistical sampling

Whereas Purposive Sampling which is also known as Judgmental Sampling is Nonprobability sampling.

 

CISA Type Question 17

Which of the following sampling method is likely to LEAST represent a population

1. Simple Random sampling
2. Stratified Random Sampling
3. Multistage Cluster Sampling
4. Purposive sampling.

 

Answer to CISA Type Question 16

So far, I have received almost five emails and two comments suggesting answer to CISA Type Question 16.

Other than one all suggested 1. Physical Layer as answer.I do agree with them.Not only hybrid type of firewall but I believe no firewall can work  and protect Physical layer. So, the correct answer is definitely 1. Physical layer.

 

 

I encourage all of you to post your comment or write to us as sharing of knowledge will make you successful in CISA Exam. Remember the purpose of this blog is to promote CISA and ISACA by motivating every CISA aspirants. As soon as you decide for taking CISA exam, I recommend to take membership of ISACA at http://www.isaca.org. The Control Journal given to members is one of the best IS related journal of present era.I very eagerly wait for this Journal every  two months.This magazine will be beneficial for your CISA preparation as well.Beside this you will get discounts for CISA Exam and CISA Review Manual and many other benefits.

 

Again all the best for your CISA ambition.

Read More......

CAAT for CISA Exam

CISA Quick Point 15

CAAT stands for Computer Assisted Audit Technique.
Question may be asked how an IS auditor will evaluate CAAT or by what way CAAT will be audited ?
I believe different types of tests can be the best way of evaluating CAAT.

CISA Type Question 15

An IS Auditor is evaluating /auditing a Computer Assisted Audit Technique (CAAT) for a large Insurance firm.He has conducted a lot of tests with the CAAT application over a period of time. Beside the tests conducted which out of the following will be the best way to evaluate the CAAT?

1. CAAT Product Manual/Documentation
2. Look of the CAAT
3. Speed of operation of CAAT
4. Price of CAAT


Answer to CISA Type Question 14.
Integration test involves integration of different unit/module. A single unit test result may not have as large impact as the integration test. Although I believe integration test is most crucial in most cases (out of all types of tests). Out of the two given in the choices definitely Unit test results will be of lesser impact.
So, the correct answer will be 1. Unit Testing Results




Further Reference:
1. CISA Review Manual by published ISACA
2. http://www.isaca.org/

Read More......

More Audit Evidence for CISA Exam

CISA Quick Tips 11:

 

Appropriate documented audit evidence should be there to support the audit

 

results.

 

 

CISA Type Question 11 :

An IS Auditor while conducting an IS audit assignment collects various

evidences. After evaluating he finds that audit evidence are reliable

& pertinent but not sufficient. What will be MOST appropriate course

of action for the IS Auditor?

1. IS Auditor should give logical end to the audit based on audit

 

   evidence already collected

 

2. IS Auditor should try to obtain additional evidence

 

3. IS Auditor should complete the audit at that moment and inform 

 

   auditee about sufficiency issue.

 

4. IS Auditor should quit the IS Audit.

 

 

Further reference:

 

1. ISACA IS Audit Standard, Policies & Guidelines

 

2. http://www.isaca.org

 

 

Answer to CISA Type Question 10:

 

 

Answer is 1. Heuristic in nature

Read More......

Audit Evidence gathering for CISA Exam- How an IS Auditor gathers audit evidence

CISA-PTR 5

Some Important Techniques for gathering audit evidence includes

Observation ^{[Very Important]}

Interview/Inspection/Inquiry

Analysis of

Organizational Structure

Policy, Procedures & Standards

Examination

Tests & Checks

CISA Type Question 5.

An IS Auditor while auditing the IS setup of a construction firm has

collected audit evidence by various methods. Evidence collected by

which of the following methods can be proved MOST important?

1. Inquiry

2. Observation

3. Assessment

4. Vouching.

Answer to CISA Type Question 4.

Correct Answer is 2. Planning

Further Reference:

1. CISA Review Manual published by ISACA.

2. http://www.isaca.org

Read More......

Prepare for CISA Exam by helping IS Auditors in starting IS Audit Assignment

CISA - PTR

Typical IS Audit Steps (may vary from audit to audit) [IS Audit Process]

For complete detail read CISA Review Manual published by ISACA

CISA Type Question 4.

IS Audit of a Big Financial Management system has been entrusted to a group of IS Auditors. What step IS Auditors are likely to follow first? [IS Audit Process]

1. Reporting

2. Planning

3. Control Evaluation

4. Risk Calculation

Answer to CISA Type Question 3.

All of the choices (1,2 & 3) are against the principle of Independence. So, the correct answer is 4. More than one of the above

Want Some Free CISA Questions:

cccure.org had collection some good questions for CISA Preparation. Candidate may visit the site to check if the questions are available.

Visit http://www.cccure.org

OR

http://www.freepracticetests.org/quiz/quiz.php

Further Reference: 1. CISA Review Manual published by ISACA. 2. http://www.isaca.org

Read More......

CISA Made Easy - How important is look of an IS Auditor ?

CISA - PTR

An IS Auditor should be [IS Audit Process]

Professionally & Technically competent and updated

&

Independent of auditee in Form, Attitude & Conduct

CISA Type Question 3.

Which of the following does not support Principle of Independence in  IS

Audit Process? [IS Audit Process]

1. Auditing an application package developed by auditor himself

2. Auditing friend's firm in which auditor is a minority stake holder

3. Auditing a firm promoted by auditor's himself

4. More than one of the above

All CISA aspirants must have clear and basic idea of ISACA IS Audit

        Standards. For details you may visit http://www.isaca.org/

CISA Review Manual (CRM) also contains outline of ISACA IS Audit

Standards, Guidelines & Procedure. Make sure you understand each of the

points given in CRM.

• I shall try to give brief relationship between Standard, Guidelines &

Procedure later in my PTR.

• Do read relevant article meant for members/non members from

http://www.isaca.org/

Answer to CISA Type Question 2.

Most of the current days Hardware firewall support device logging which

can be used as audit trail for determining intrusion. Audit of Software

firewall (Desktop Firewall) also need review of related Operating System

Logs. So, the Correct answer is 3. Both 1 & 2

Read More......

What an Audit Charter should document

CISA-PTR 1

Audit Charter/Engagement Letter should clearly document

Ø Accountabilities

Ø Authorities

Ø Purpose/Scope &

Ø Responsibilities

of audit function

 

CISA Type Question 1.

 

Which of the following is LEAST important characteristics of Audit

Charter?

 

1. Audit Charter delegates authority from one person/organization to

 

 

 

another person/organization

 

2. Audit Charter should document Purpose, Accountabilities &

Responsibilities related to Audit function

 

3. Audit charter should describe independence, objectivity and Standards

of Audit to be conducted

4. Audit Charter is only related to scope of the Audit.

Read More......