- (Topic 4)
If a source code is not recompiled when program changes are implemented, which of the following is a compensating control to ensure synchronization of source and object?

1. A. Comparison of object and executable code
2. B. Review of audit trail of compile dates
3. C. Comparison of date stamping of source and object code
4. D. Review of developer comments in executable code

Correct Answer: C
Source code synchronization is the process of ensuring that the source code and the object code (the compiled version of the source code) are consistent and up-to-date1. When program changes are implemented, the source code should be recompiled to generate a new object code that reflects the changes. However, if the source code is not recompiled, there is a risk that the object code may be outdated or incorrect. A compensating control is a measure that reduces the risk of an existing control weakness or deficiency2. A compensating control for source code synchronization is to compare the date stamping of the source and object code. Date stamping is a method of recording the date and time when a file is created or modified3. By comparing the date stamping of the source and object code, one can verify if they are synchronized or not. If the date stamping of the source code is newer than the object code, it means that the source code has been changed but not recompiled. If the date stamping of the object code is newer than the source code, it means that the object code has been compiled from a different source
code. If the date stamping of both files are identical, it means that they are synchronized.

- (Topic 4)
When testing the accuracy of transaction data, which of the following situations BEST justifies the use of a smaller sample size?

1. A. The IS audit staff has a high level of experience.
2. B. It is expected that the population is error-free.
3. C. Proper segregation of duties is in place.
4. D. The data can be directly changed by users.

Correct Answer: B
The best situation that justifies the use of a smaller sample size when testing the accuracy of transaction data is B. It is expected that the population is error-free. The sample size is the number of items selected from the population for testing. The sample size depends on various factors, such as the level of confidence, the tolerable error rate, the expected error rate, and the variability of the population. A smaller sample size means that fewer items are tested, which reduces the cost and time of testing, but also increases the sampling risk (the risk that the sample is not representative of the population).
One of the factors that affects the sample size is the expected error rate, which is the auditor’s best estimate of the proportion of errors in the population before testing. A higher expected error rate means that more errors are likely to be found in the population, which requires a larger sample size to provide sufficient evidence for the auditor’s conclusion. A lower expected error rate means that fewer errors are likely to be found in the population, which allows a smaller sample size to provide sufficient evidence for the auditor’s conclusion. Therefore, if it is expected that the population is error-free (i.e., the expected error rate is zero or very low), a smaller sample size can be justified.
The other situations do not justify the use of a smaller sample size when testing the accuracy of transaction data. A. The IS audit staff has a high level of experience. The IS audit staff’s level of experience does not affect the sample size, but rather their ability to design and execute the sampling procedures and evaluate the results. The IS audit staff’s level of experience may affect their judgment in selecting and applying sampling methods, but it does not change the statistical or mathematical principles that determine the sample size. B. Proper segregation of duties is in place. Proper segregation of duties is an internal control that helps prevent or detect errors or fraud in transaction processing, but it does not affect the sample size. The sample size is based on the characteristics of the population and the objectives of testing, not on the controls in place. Proper segregation of duties may reduce the likelihood or impact of errors or fraud in transaction processing, but it does not eliminate them completely. Therefore, proper segregation of duties does not justify a smaller sample size when testing the accuracy of transaction data. C. The data can be directly changed by users. The data’s ability to be directly changed by users does not justify a smaller sample size, but rather a larger one. The data’s ability to be directly changed by users increases the risk of errors or fraud in transaction processing, which requires a larger sample size to provide sufficient evidence for the auditor’s conclusion. The data’s ability to be directly changed by users also increases the variability of the population, which affects the sample size.
References:
✑ ISACA, CISA Review Manual, 27th Edition, 2019, p. 2471
✑ ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2
✑ Audit Sampling - AICPA3
✑ How to choose a sample size (for the statistically challenged)

- (Topic 2)
Which of the following findings from an IT governance review should be of GREATEST concern?

1. A. The IT budget is not monitored
2. B. All IT services are provided by third parties.
3. C. IT value analysis has not been completed.
4. D. IT supports two different operating systems.

Correct Answer: C
IT value analysis has not been completed is a finding from an IT governance review that should be of greatest concern. IT value analysis is a process of measuring and demonstrating the contribution of IT to the organization’s goals and objectives. An IS auditor should be concerned about the lack of IT value analysis, as it may indicate that the IT investments and resources are not aligned with the business needs and expectations, or that the IT performance and outcomes are not monitored and evaluated. The other options are less critical findings that may not have a significant impact on the IT governance. References:
✑ CISA Review Manual (Digital Version), Chapter 5, Section 5.11
✑ CISA Review Questions, Answers & Explanations Database, Question ID 218

- (Topic 4)
In which of the following system development life cycle (SDLC) phases would an IS auditor expect to find that controls have been incorporated into system specifications?

1. A. Implementation
2. B. Development
3. C. Feasibility
4. D. Design

Correct Answer: D
The design phase of the system development life cycle (SDLC) is where an IS auditor would expect to find that controls have been incorporated into system specifications, because this is where the system requirements are translated into detailed design specifications that include the technical, functional, and security aspects of the system34. The implementation phase is where the system is deployed and tested, the development phase is where the system is coded and unit tested, and the feasibility phase is where the system objectives and scope are defined. References: 3: CISA Review Manual (Digital Version), Chapter 4, Section 4.2.2 4: CISA Online Review Course, Module 4, Lesson 2

- (Topic 4)
Which of the following should be the FIRST step when planning an IS audit of a third-party service provider that monitors network activities?

1. A. Review the third party's monitoring logs and incident handling
2. B. Review the roles and responsibilities of the third-party provider
3. C. Evaluate the organization's third-party monitoring process
4. D. Determine if the organization has a secure connection to the provider

Correct Answer: B
The first step when planning an IS audit of a third-party service provider that monitors network activities is to review the roles and responsibilities of the third-party provider. This will help to establish the scope, objectives, and expectations of the audit, as well as to identify any potential risks, issues, or gaps in the service level agreement (SLA) between the organization and the provider. Reviewing the third party’s monitoring logs and incident handling, evaluating the organization’s third-party monitoring process, and determining if the organization has a secure connection to the provider are important steps, but they should be performed after reviewing the roles and responsibilities of the provider. References: CISA Review Manual (Digital Version)1, page 269.