BTCN Câu hỏi ôn C2

5. State the significance of an audit schedule in "IT Control and Audit"

- Risk Assessment: Regular audits help identify vulnerabilities and assess risks associated with
an organization’s IT environment
- Proactive Measures: By conducting scheduled audits, businesses can proactively address
potential weaknesses, reduce security breaches, and mitigate technological risks⁵⁹.
- Compliance and Controls: Audits ensure adherence to regulations, industry best practices,
and standards. Popular IT compliance audits include SOC 1 and SOC 2 audits
- Enhanced Reliability: Auditing provides visibility into the effectiveness of IT systems,
enhancing reliability, confidentiality, and availability of data.

8. What specific information or evidence can an IT auditor gather for a client that uses
its IT environment to store and process financially significant data?
- Internal Accounting Controls: These controls ensure the accuracy and reliability of financial
transactions within the IT systems.
- Operational Controls: These focus on efficient and effective IT processes related to
financial data.
- Administrative Controls: These govern access, authorization, and management of financial
information.
- Organizational Security Policies and Procedures: Ensuring data security and compliance.
- Overall Policies for Document Design and Use: Proper documentation of financial records.
- Physical and Logical Security Policies for Data Centers and IT Resources: Safeguarding
financial data1.

10. Describe the procedures IT auditors perform in order to test controls, processes, and
exposures.
- Inquiry: Auditors ask management and staff about controls to gather relevant information.
This method is often used alongside other more reliable techniques. For instance, an auditor
might inquire about visitor escort policies if direct observation isn’t feasible.
- Observation: Activities and operations are directly observed. This is useful when there’s no
documented evidence of control operation, such as verifying the presence of security cameras
or fire suppression systems.
- Examination or Inspection of Evidence: Auditors assess whether manual controls are being
performed. For example, they verify if backups are scheduled regularly or if forms are
correctly filled out.
- Re-performance: Auditors independently execute control procedures to validate their
effectiveness. This involves repeating specific actions to ensure consistency.
- Computer-Assisted Audit Techniques (CAAT): Auditors use specialized software tools to
analyze large volumes of data efficiently. CAAT helps identify anomalies or patterns that may
indicate control weaknesses