Free readiness test
ISACA CISA®: 40 free scenario questions
Prepare for the ISACA CISA exam across all five domains — audit process, IT governance, acquisition and development, operations and resilience, and protection of information assets.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
You are the IT audit manager at a mid-sized bank preparing next year's audit plan with 1,200 audit hours. Management requests audits of the HR leave system and the intranet because 'they are easy to complete'. Meanwhile, the bank is migrating its core banking system to a new vendor in six months, has outsourced card processing to a third party that has never been audited, and suffered a ransomware incident last year that encrypted two branch servers. The regulator recently issued new requirements for cyber resilience and third-party risk. The audit committee chair wants a plan that 'gives the board real assurance'. Your team has strong application audit skills but limited cloud expertise, and the core banking migration will use a cloud-hosted platform. Last year's plan was completed, but none of its audits covered cloud or third parties.
Which approach to building the audit plan is BEST?
- AAccept management's suggested audits because they are achievable within the available hours.
- BAllocate hours evenly across all IT systems to ensure full coverage.
- CRisk-assess the audit universe and close the cloud skills gap.
- DAsk the regulator which audits to perform.