CISA-KR 문제 596
애플리케이션을 설계하는 데 중요한 역할을 한 IS 감사원은 애플리케이션을 검토하도록 요청받습니다. 감사원은 다음을 수행해야 합니다.
정답: C
The IS auditor should inform audit management of the earlier involvement in designing the application. This is to ensure that there is no conflict of interest or bias that may affect the objectivity or independence of the audit. Audit management can then decide whether to assign a different auditor or to proceed with the same auditor with appropriate safeguards. The other options are not appropriate for the IS auditor to do in this situation. Refusing the assignment to avoid conflict of interest is an extreme measure that may not be necessary or feasible, especially if there are no other qualified auditors available. Using the knowledge of the application to carry out the audit is risky, as it may lead to overlooking or ignoring potential issues or errors in the application. Modifying the scope of the audit is not advisable, as it may compromise the quality or completeness of the audit. References: CISA Review Manual (Digital Version), Chapter 2, Section 2.1
CISA-KR 문제 597
내부 감사팀은 다른 국가의 제3자가 호스팅하는 감사 관리 애플리케이션을 사용할지 여부를 결정하고 있습니다.
호스팅된 애플리케이션에 급여 감사 문서를 업로드하는 것과 관련하여 가장 중요한 고려 사항은 무엇입니까?
호스팅된 애플리케이션에 급여 감사 문서를 업로드하는 것과 관련하여 가장 중요한 고려 사항은 무엇입니까?
정답: C
This is because privacy regulations are laws or rules that protect the personal information of individuals from unauthorized access, use, disclosure, or transfer by third parties. Payroll audit documentation may contain sensitive and confidential data, such as employee names, salaries, benefits, taxes, deductions, and bank accounts. If the audit management application is hosted by a third party in a different country, the organization may need to comply with the privacy regulations of both its own country and the host country, as well as any international or regional agreements or frameworks that apply. Privacy regulations may impose various requirements and obligations on the organization, such as obtaining consent from the data subjects, implementing appropriate security measures, notifying data breaches, and ensuring data quality and accuracy.
Privacy regulations may also grant various rights to the data subjects, such as accessing, correcting, deleting, or transferring their data. Failing to comply with privacy regulations may expose the organization to significant risks and consequences, such as legal actions, fines, sanctions, reputational damage, or loss of trust.
Some examples of privacy regulations affecting the organization are:
* The General Data Protection Regulation (GDPR), which is a comprehensive and strict privacy regulation that applies to any organization that processes personal data of individuals in the European Union (EU) or offers goods or services to them, regardless of where the organization or the data is located1.
* The California Consumer Privacy Act (CCPA), which is a broad and influential privacy regulation that applies to any organization that collects personal information of California residents and meets certain thresholds of revenue, data volume, or data sharing2.
* The Health Insurance Portability and Accountability Act (HIPAA), which is a sector-specific privacy regulation that applies to any organization that handles protected health information (PHI) of individuals in the United States, such as health care providers, health plans, or health care clearinghouses3.
Therefore, before using an audit management application hosted by a third party in a different country, the internal audit team should conduct a thorough assessment of the privacy regulations affecting the organization and ensure that they have adequate policies, procedures, and controls in place to comply with them.
Privacy regulations may also grant various rights to the data subjects, such as accessing, correcting, deleting, or transferring their data. Failing to comply with privacy regulations may expose the organization to significant risks and consequences, such as legal actions, fines, sanctions, reputational damage, or loss of trust.
Some examples of privacy regulations affecting the organization are:
* The General Data Protection Regulation (GDPR), which is a comprehensive and strict privacy regulation that applies to any organization that processes personal data of individuals in the European Union (EU) or offers goods or services to them, regardless of where the organization or the data is located1.
* The California Consumer Privacy Act (CCPA), which is a broad and influential privacy regulation that applies to any organization that collects personal information of California residents and meets certain thresholds of revenue, data volume, or data sharing2.
* The Health Insurance Portability and Accountability Act (HIPAA), which is a sector-specific privacy regulation that applies to any organization that handles protected health information (PHI) of individuals in the United States, such as health care providers, health plans, or health care clearinghouses3.
Therefore, before using an audit management application hosted by a third party in a different country, the internal audit team should conduct a thorough assessment of the privacy regulations affecting the organization and ensure that they have adequate policies, procedures, and controls in place to comply with them.
CISA-KR 문제 598
사고로 인해 내부 서버에 접근할 수 없게 되어 정상적인 비즈니스 운영이 중단된 경우 다음 중 가장 먼저 수행해야 하는 작업은 무엇입니까?
정답: A
CISA-KR 문제 599
연간 감사 계획 과정의 일부로 반드시 완료해야 하는 것은 무엇입니까?
정답: C
Risk assessment is a mandatory part of the annual audit planning process, as it helps to identify and prioritize the areas that pose the highest risk to the organization's objectives and operations. Risk assessment involves analyzing the internal and external factors that affect the organization's risk profile, evaluating the likelihood and impact of potential events or scenarios, assessing the existing controls and mitigation strategies, and determining the residual risk level. Based on the risk assessment results, the IS auditor can allocate resources and schedule audits accordingly. A business impact analysis (BIA) is a process that identifies and evaluates the critical business functions and processes that could be disrupted by a disaster or incident, and estimates the potential impact on the organization's operations, reputation and finances. A BIA is not a mandatory part of the annual audit planning process, but it can be used as an input for risk assessment or as a subject for audit. Fieldwork is the phase of an audit where the IS auditor collects evidence to support the audit objectives and conclusions. Fieldwork is not part of the annual audit planning process, but it is part of each individual audit engagement. A risk control matrix is a tool that maps the risks identified in a risk assessment to the controls that mitigate them. A risk control matrix is not a mandatory part of the annual audit planning process, but it can be used as an output of risk assessment or as a tool for audit testing. References: CISA Review Manual (Digital Version) 1, Chapter 1: Information Systems Auditing Process, Section 1.2: Audit Planning.
CISA-KR 문제 600
은행은 온라인 뱅킹의 일부로 기업 고객 계좌(더 높은 금전적 가치)와 중소기업 계좌(더 낮은 금전적 가치)를 조합합니다. IS 감사자가 이러한 계좌에 사용할 수 있는 최상의 샘플링 접근 방식은 다음 중 어느 것입니까?
정답: B
Stratified mean per unit sampling is a method of audit sampling that divides the population into subgroups (strata) based on some characteristic, such as monetary value, and then selects a sample from each stratum using mean per unit sampling. Mean per unit sampling is a method of audit sampling that estimates the total value of a population by multiplying the average value of the sample items by the number of items in the population. Stratified mean per unit sampling is suitable for populations that have a high variability or a skewed distribution, such as the bank accounts in this question. By stratifying the population, the auditor can reduce the sampling error and increase the precision of the estimate.
Difference estimation sampling (option A) is not the best sampling approach for these accounts. Difference estimation sampling is a method of audit sampling that estimates the total error or misstatement in a population by multiplying the average difference between the book value and the audited value of the sample items by the number of items in the population. Difference estimation sampling is suitable for populations that have a low variability and a symmetrical distribution, which is not the case for the bank accounts in this question.
Customer unit sampling (option C) is not a sampling approach, but a type of monetary unit sampling.
Monetary unit sampling is a method of audit sampling that selects sample items based on their monetary value, rather than their physical units. Customer unit sampling is a variation of monetary unit sampling that treats each customer account as a single unit, regardless of how many transactions or balances it contains.
Customer unit sampling may be appropriate for testing existence or occurrence assertions, but not for estimating total values.
Unstratified mean per unit sampling (option D) is not the best sampling approach for these accounts.
Unstratified mean per unit sampling is a method of audit sampling that applies mean per unit sampling to the entire population without dividing it into subgroups. Unstratified mean per unit sampling may result in a larger sample size and a lower precision than stratified mean per unit sampling, especially for populations that have a high variability or a skewed distribution, such as the bank accounts in this question.
Therefore, option B is the correct answer.
References:
* Audit Sampling - AICPA
* Audit Sampling: Examples and Guidance To The Sampling Methods
* Audit Sampling |Audit | Financial Audit - Scribd
Difference estimation sampling (option A) is not the best sampling approach for these accounts. Difference estimation sampling is a method of audit sampling that estimates the total error or misstatement in a population by multiplying the average difference between the book value and the audited value of the sample items by the number of items in the population. Difference estimation sampling is suitable for populations that have a low variability and a symmetrical distribution, which is not the case for the bank accounts in this question.
Customer unit sampling (option C) is not a sampling approach, but a type of monetary unit sampling.
Monetary unit sampling is a method of audit sampling that selects sample items based on their monetary value, rather than their physical units. Customer unit sampling is a variation of monetary unit sampling that treats each customer account as a single unit, regardless of how many transactions or balances it contains.
Customer unit sampling may be appropriate for testing existence or occurrence assertions, but not for estimating total values.
Unstratified mean per unit sampling (option D) is not the best sampling approach for these accounts.
Unstratified mean per unit sampling is a method of audit sampling that applies mean per unit sampling to the entire population without dividing it into subgroups. Unstratified mean per unit sampling may result in a larger sample size and a lower precision than stratified mean per unit sampling, especially for populations that have a high variability or a skewed distribution, such as the bank accounts in this question.
Therefore, option B is the correct answer.
References:
* Audit Sampling - AICPA
* Audit Sampling: Examples and Guidance To The Sampling Methods
* Audit Sampling |Audit | Financial Audit - Scribd
- 다른 버전
- 356ISACA.CISA-KR.v2026-08-15.q712
- 4380ISACA.CISA-KR.v2026-05-16.q709
- 1876ISACA.CISA-KR.v2026-05-06.q261
- 3350ISACA.CISA-KR.v2026-03-16.q665
- 4751ISACA.CISA-KR.v2026-03-07.q651
- 9455ISACA.CISA-KR.v2025-04-07.q633
- 3814ISACA.CISA-KR.v2025-04-02.q544
- 4321ISACA.CISA-KR.v2025-03-31.q534
- 5533ISACA.CISA-KR.v2025-03-28.q617
- 3316ISACA.CISA-KR.v2025-03-19.q581
- 4202ISACA.CISA-KR.v2025-03-03.q807
- 5250ISACA.CISA-KR.v2024-02-07.q421
- 2943ISACA.CISA-KR.v2024-01-31.q392
- 5447ISACA.CISA-KR.v2023-10-24.q329
- 5268ISACA.CISA-KR.v2023-07-31.q266
- 3265ISACA.CISA-KR.v2023-06-23.q324
- 최근 업로드
- 221Microsoft.AZ-305-KR.v2026-08-17.q162
- 167IIA.IAA-IAP-KR.v2026-08-17.q41
- 356ISACA.CISA-KR.v2026-08-15.q712
- 286Microsoft.MS-700-KR.v2026-08-15.q203
- 212Microsoft.AZ-305-KR.v2026-08-14.q177
- 275Microsoft.DP-900-KR.v2026-08-13.q130
- 323Microsoft.PL-600.v2026-08-11.q206
- 293Microsoft.DP-100.v2026-08-11.q160
- 215Oracle.1Z0-1048-25.v2026-08-11.q68
- 185ISQI.CTAL-TAE.v2026-08-11.q37
[×]
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. ISACA.CISA-KR.v2025-04-03.q628 모의시험 시험자료를 다운 받으세요.