Certified Information Systems Auditor (CISA) | Domain 1 Audit Execution and Reporting 02

If the sample is drawn from an incomplete population, its results cannot properly be projected onto the population.

Data analytics can extract from the whole population the transactions that meet the duplication criteria.

Evidence the auditor obtains directly from an independent external source is generally the most reliable.

Tracing from HR records and re-performing the check lets the auditor confirm operating effectiveness directly.

Oral explanations need to be checked against other objective evidence to make them more reliable.

Statistical methods allow the precision of the result and the sampling risk to be evaluated in probabilistic terms.

Working papers record the basis for the audit work and judgements, making review and quality control possible.

Addressing the cause rather than the surface exception leads to lasting improvement.

Risk acceptance should be made by someone with the appropriate authority, and anything beyond the tolerance should be escalated.