Free CISA practice questions

The IS audit charter is the document that establishes the audit function's purpose, responsibility, authority and accountability.

Because the charter is the source of the audit function's authority, it is approved at the highest level of governance: the board, usually through its audit committee. Approval there protects the function from being limited by the managers it audits. The chief audit executive prepares it, IT management is the auditee, and the external auditor has no role in the internal mandate.

1. Recall what the charter does: it grants authority and defines responsibility.
2. Ask who can grant authority over the whole organization, including senior management.
3. Exclude the auditee and the audit function itself.
4. Choose the board or its audit committee.

Exam tip: The audit charter is approved by the board or audit committee, never by the auditee.

Governance evaluates, directs and monitors; management plans, builds, runs and monitors within that direction.

Governance is exercised by the board and its committees: they evaluate options, set direction (including how much IT-related risk is acceptable) and monitor results. Management then plans, builds, runs and monitors IT inside those boundaries. Scheduling approved upgrades, staffing projects and running the change advisory board are all management activities that carry out decisions already made, so only approving the risk level is a governance responsibility.

1. Ask who makes each decision: the board or the managers who carry out its direction.
2. Recognise direction-setting decisions such as risk appetite and strategic priorities as governance.
3. Treat scheduling, staffing and release control as management execution.
4. Pick the option that sets the boundary rather than works within it.

Exam tip: Governance sets direction and risk appetite; management executes within them.

Project governance assigns business ownership of the investment to the project sponsor.

The project sponsor is the senior business person who provides funding, owns the business case and the benefits it promises, and ultimately accepts that the delivered system meets business needs. The project manager runs the plan, quality assurance verifies adherence to standards, and analysts design the solution; all three serve the sponsor's objectives rather than own them.

1. Separate business ownership from delivery roles.
2. Ask who justified and funds the investment.
3. Recognise that the same party accepts the outcome.
4. Choose the sponsor over delivery and assurance roles.

Exam tip: The sponsor owns the business case, the funding and acceptance; the project manager owns delivery.

Common enterprise back-end devices each have a distinct role in the processing environment.

A proxy server sits between internal clients and external servers and makes requests on the clients' behalf. Because every request passes through it, it can filter content, log who visited what and cache frequently requested pages. File, application and database servers serve internal storage, business logic and data respectively; none of them relays users' internet traffic.

1. Identify the need: one point that relays user requests to the internet.
2. Ask which device acts on behalf of clients toward external servers.
3. Recognise that filtering, logging and caching follow from that position.
4. Choose the proxy server.

Exam tip: A proxy server relays client requests outward, so it is where web traffic is filtered, logged and cached.

Policy, standard, procedure and guideline each play a different role.

The policy sets direction (protect information through strong authentication). Standards make that direction specific and mandatory (passwords of at least 14 characters). Procedures tell staff how to carry out a task step by step, and guidelines offer optional advice. A required numeric value is a standard; putting it in a guideline would make it optional and putting it in the policy would force board re-approval whenever the value changes.

1. Note that the requirement is mandatory and specific.
2. Rule out guidelines, which are optional.
3. Rule out procedures, which describe how to perform tasks.
4. Keep the policy high level and choose a standard.

Exam tip: Policy says what and why; standards say exactly what is required; procedures say how; guidelines suggest.