Cgap Exam - Domain 2

Front 1

Key Components of Managing the Audit Function

Back 1

1. Purpose, authority & responsibility s/b formalized (e.g. a “charter”)
2. Policies & procedures (“tailored”)
3. Quality assurance—(good mgmt., also std.)
4. Planning (risk key factor, others in govt. )
5. Staffing (selection, development, CPE’s)
6. Marketing the audit function (how?)
7. Mission, role/outcome in government

Front 2

Topics included in audit policies and procedures:

Back 2

charter
code of ethics
standards to be followed
audit phases
details on personnel, administration

Front 3

Basic steps of an external quality, or peer, review.

Back 3

review of over-all processes
in-depth review of selected audits
ends in written report

Front 4

Internal Audit Quality Assurance review requires what?

Back 4

Supervision to:
assuring qualifications
instructing
reviewing working papers

Front 5

Audit Managements Overall Role in Planning

Back 5

Setting up audit function
Authorizing appropriate resources
Establishing goals & functions
Selecting functional areas for audit
Audit work schedules
What areas to audit & when (budget)
IIA emphasizes risk-based planning
Role of risk assessment

Front 6

What is the purpose of written policies and procedures?

Back 6

Help ensure consistent performance of audit function.

Front 7

Inherent Risk (def)

Back 7

Risk is inherent in any activity, regardless of existence or effectiveness of controls.

Interent risk is uncertainty or exposure, assuming no controls are in place.

Inherence risks are the possible adverse effects based solely on the type of activity, the type of resources, amount of assets or complexity of transactions.

Front 8

Control Risk (def)

Back 8

Control risk is the extent of uncertainty remaining after the mitigating effects of the control system are in place.

The extent to which an organization has implemented controls to minimize actual occurence of risk determines the vulnerability to the riskactually occuring is the "control risk".

Front 9

The Risk Analysis Process Involves:

Back 9

ID auditable activities
ID relevant risks
assess significance & likelihood
prioritize & manage risks

Front 10

Staffing Role of Audit Head

Back 10

- Plan personnel needs, review recruiting & selection
- Includes administration, e.g., job descriptions, evaluation, corrective discipline, etc.
- Consider all skills needed
- Staff development, including training, continuing education
- Consider E & E, may be outsourced

Front 11

Three Types of Audit Customers

Back 11

Primary - audit sponsors
Secondary - Use audit reports
Beneficiaries - general public

Front 12

Benefits of Governmant Auditing

Back 12

accountability to public
assurance for oversight bodies
help government achieve goals
presence deters F,W, A

Front 13

Types of Audit Services

Back 13

Governance, risk & control of general interest
Financial statement audits
Performance/Value-for-money audits(influence of performance initiatives)
Financial systems: audits and services
Information & technology: audits & Service
Consulting/assistance services (non-audit)
Integrity services (e.g., FWA)

Front 14

Explain Compliance Audits

Back 14

1. Test conformance with a requirement
* law, contract, grant, policy, procedure
2. Attributes of effective compliance system
* requirements documented and communicated
* properly assigned & qualified personnel
3. Can be partially a performance audit

Front 15

Purpose of a Financial Statement Audit

Back 15

To issue an opinion about whether an entities financial statements are presented fairly in all material respects in conformity with an applicable financial reporting framework.

Front 16

Types of Financial Statememnt Opinions

Back 16

Unqualified
Qualified
Adverse
Disclaimer

Front 17

Unqualified Opinion (def)

Back 17

Clean - no material misstatements

Front 18

Qualified Opinion (def)

Back 18

Fairly presented, except for identified items

Front 19

Adverse Opinion (def)

Back 19

Statements DO NOT fairly present

Front 20

Disclaimer Opinion (def)

Back 20

No opinion expressed

Front 21

Two key ideas in financial statement audits

Back 21

1. consideration of material line items and accounts in deciding the focus of the audit.
2. limiting or minimizing audit risk

Front 22

Five Management Assertions that are reviewed in Financial Statement Audits are

Back 22

1. Existence/Occurrence – actually exists
2. Completeness – does not omit anything
3. Valuation – proper amounts
4. Rights & obligations—e.g., ownership
5. Presentation & disclosure—e.g., GAAP

Front 23

Two internal control weaknesses cited in financial statement audits

Back 23

Significant deficiency
Material Weakness

Front 24

Significant Deficiency (def)

Back 24

Less severe than a material weakness, yet important enough to merit attention by those charged with giovernance.

Front 25

Material Weakness (def)

Back 25

A significant deficiency, or combination of significant deficiencies, that results in more than a remote likliehood that a material misstatement of the financial statements will not be prevented or detected.

Front 26

Describe Performance Audits

Back 26

1. vide assurance or conclusions based on evaluation of “sufficient, appropriate”* evidence against criteria
2. vide objective analysis for management, & those in governance and oversight
3. Can lead to improved programs, reduced costs, better accountability

Front 27

Ways Performance Auditors Assist Government Policymakers

Back 27

1. Provide key information
2. Offer conclusions on E, E & E
3. Questions for oversight hearings
4. Evaluating new or proposed programs
4. Forecasting potential program results
5. Performing/assisting investigations

Front 28

GAGAS Definition of Economy and Efficiency Performance Audits

Back 28

right resources, amount, time, costs
maximum output for lowest input (quality)
compliance with E &E laws, requirements

Front 29

GAGAS Definition of Program Performance Audits

Back 29

achieving objectives, outputs, outcomes
compliance with mandated results

Front 30

INTOSAI's Definition of a Performance Audit

Back 30

Concerned witrh economu, efficiency, and effectiveness.

Front 31

The focus of process and controls based performance auditing

Back 31

examining the adequacy of how things are done to achieve one or more aspects of performance.

Assess controls as the condition finding element

Front 32

The focus of measurement based performance auditing

Back 32

measuring and assessing the adequacy of results being achieved for one or more aspects of performance

Front 33

The focus of impact based performance auditing

Back 33

evaluating the change attributable (at least in part) to an intervention (a new process, program, etc.)

Assess controls as possible cause finding element

Front 34

What is a targeted (narrow-scope) approach to performance auditing?

Back 34

when audit objective targets a specific control weakness

Front 35

What is a comprehensive approach to performance auditing?

Back 35

when audit objective is to review how adequately the auditee performs a function, service, or activity
more elaborate approach, starting with a vulnerability assessment.

Front 36

Three types of attestations

Back 36

1. Examiniation
2. Review
3. Agreed-upon Proceedures

Front 37

Examination Attestation (def)

Back 37

An opinion on all material respects

Front 38

Review Attestation (def)

Back 38

Essentially negative assuraqnce, i.e. nothing came to the auditrs attention.

Front 39

Agreed-Upon Proceedures Attestation (def)

Back 39

Specific proceedures on a subject matter

Front 40

Criteria for Effective Controls

Back 40

1. Directiveness
2. Magnitude of exception
3. Method of Application
4. Follow-up

Front 41

What IT audits do (two kinds)

Back 41

1. Evaluate the reliability of computerized information that supports reporting in financial, performance or other areas
2. Look at the how effective controls are to reduce the potential for adverse consequences from fraud, errors, security breaches, and disasters.

Front 42

IT Issues of Concern for Auditors

Back 42

1. Information & Process Integrity
2. Disaster Contingency Planning
3. Controls: General and Applications
* Input
* Processing
* Output
4. Systems Development Processes
5. Many other possibilities

Front 43

Three Useful IT References for Auditors

Back 43

1. US GAO’s Federal Information Systems Control Manual (FISCAM)
2. IT Standards, Guidelines, and Tools and Techniques for Audit and Assurance Control Professionals, ISACA
3. The IIA’S Global Technology Audit Guides (GTAGs) & Guide to Assessment of IT Risk (GAIT)

Front 44

Elements of Information and Process Integrity (According to COBIT Report)

Back 44

Authorized
Accurate
Complete
Timely
Recorded, processed, & reported timely
Secure

Front 45

Elements of Information and Process Integrity
Authorized (def)

Back 45

An element of information, from a transaction to an entire system, is appropriately entered, developed, changed, or used with proper authority.

Front 46

Elements of Information and Process Integrity
Accurate (def)

Back 46

The information and associated processes are correct and may be used as intended.

Front 47

Elements of Information and Process Integrity
Complete (def)

Back 47

No required information is missing. Conversely, information is not duplicated. Rejected transactions are identified, controlled, and reentered as appropriate.

Front 48

Elements of Information and Process Integrity
Timely (def)

Back 48

The work (e.g. transactions, processes) is promptly processed and customer service levels are maintained.

Front 49

Elements of Information and Process Integrity
Recorded (def)

Back 49

Appropriate period and other cutoff dates are followed.

Front 50

Elements of Information and Process Integrity
Secure (def)

Back 50

The information and processes are protected from unauthorized access, update, disclosure, or destruction.

Front 51

Selection's Impact on Data Integrity

Back 51

How much data to obtain, retain, and process.

Front 52

Collections impacto on data integrity

Back 52

Effectiveness of input controls

Front 53

Classifictaion's impact on data integrity

Back 53

helps control risks associated with alteration and disclosure.

Front 54

Reporting's impact on data integrity

Back 54

Appropriate dissemination

Front 55

Storing's impact on data integrity

Back 55

securely store backup data

Front 56

IT General Access Controls Auditors Should Be Concerned With

Back 56

1. Administration
2. Computer Operations
3. Security Controls
4. Security Administration
5. Syetem Programmers
6. Telecommunications Systems
7. Systems Software

Front 57

General Access Control - Administration Controls (def)

Back 57

procedures necessary to ensure thta resources are used efficiently and in accordance with management intentions.

Front 58

General Access Control - Computer Operations (def)

Back 58

Must ensurer that processing meets specifications by requiring rge logginf of all actions initiated by computer operators and actions performed by computer software.

Front 59

General Access Control - Security Administration(def)

Back 59

Security over the computer facility, including all aspects of physical and data security.

Front 60

General Access Control - System Programmers (def)

Back 60

Control the operation of teh computer system and are responsible for the efficient use of computer resources.

Front 61

General Access Control - Telecommunciations Systems (def)

Back 61

Control The transmission of messages between users and the computer.

Front 62

General Access Control - Systems Softwaren (def)

Back 62

Programs and routines that control computer processing.

Front 63

Three Types of IT Application Access Controls

Back 63

Input
Processing
Output

Front 64

Input Controls (def)

Back 64

Accuracy and completeness of data entered into an application.

Front 65

Examples of Edit Controls

Back 65

Field Test, Validity, Reasonableness, completenes checks, check digit tests, and transaction logs.

Front 66

Processing Controls (def)

Back 66

concerned with the proper processing of data entered into an application. Examples - record counts, header/footer info, escho checks.

Front 67

Output Controls (def)

Back 67

Concerned with the verification and proper distribution of computer output.

Front 68

Three examples of controls over Systems Development

Back 68

1. Appropriate standards, policies, and procedures to control systems and programming functions
2. Standards to assure proper authorization, testing, review, documentation, implementation, & approval
3. User & management participation

Front 69

Categories of Integrity Ciolations

Back 69

Fraud
Noncompliance
Waste
Irregularities
Abuse (may be hard to define)

Front 70

Auditors Involvement in Fraud, Waste, and Abuse

Back 70

* Auditors have key role
* Must consider possible integrity issues in planning audits, but not guaranteed
* Significance includes $$$ and public perception
* If possibilities exist, more audit steps may be required.

Front 71

Documenting Evidence in Integrity Audits

Back 71

- Sufficient, competent, reliable evidence even more important than in other engagements
- Awareness that management could be involved
- Know proper techniques for obtaining, documenting & securing evidence

Front 72

Factors to Consider when Chosing Performance Audit Subjects

Back 72

Risk
Significance/materiality
Oversight body interest
Public interest
Statutes & requests
Past problems still uncorrected
Time since last audit

Front 73

Objectives (def)

Back 73

what the audit is to accomplish

Front 74

Audit Scope (def)

Back 74

time period, locations, people, need for expertise, & other considerations

Front 75

Audit Methodology (def)

Back 75

work in data gathering and analysis (e.g., use of sampling)

Front 76

Well Stated Objectives Identify:

Back 76

- subject (organization, program, activity, function)
- performance aspect(s) to be audited
- potential finding and reporting elements to be pursued

Front 77

Categories of Risk and Control Assessment

Back 77

Preventative
Detective
Corrective
Directive

Front 78

Categories of Evidence

Back 78

Primary or direct (I saw)
Secondary (I was told)
Corroborative (supporting)

Front 79

Classifications of Evidence

Back 79

Documentary
Analytical
Testimonial
Physical

Front 80

Qualities of Evidence

Back 80

Sufficiency
Relevency
Appropriateness
Reasonableness and Usefulness

Front 81

Elements of A Finding

Back 81

Condition (what is)
Criteria (what shoudl be)
Cause (why)
Effect (so what)

Front 82

Role of Working Papers

Back 82

support report
manage audit progress
quality reviews

Front 83

Ways to test validity of evidence

Back 83

Corroborate evidence – with another source
Verify evidence – to its source
Validate evidence – with objective reality
Obtain additional evidence

Front 84

Type of finding that has only the condition element

Back 84

Descriptive

Front 85

Type of finding that has only the condition and criteria elements

Back 85

Normative