Directors may use a tool called "risk analysis" in preparing work schedules. Which of the following would not be considered in performing a risk analysis?

a. Financial exposure and potential loss.

b. Skills available on the audit staff.

c. Results of prior audits.

d. Major operating changes.

Factors that should be considered when evaluating audit risk in an IS functional area include:

1. Volume of transactions.

2. Degree of system integration.

3. Years since last audit.

4. Significant management turnover.

5. Value of "assets at risk."

6. Average value per transaction.

7. Results of last audit.

Factors that best define materiality of audit risk are:

a. 1 through 7.

b. 2, 4, and 7.

c. 1, 5, and 6.

d. 3, 4, and 6.

A risk that measures the likelihood that a control process is not effective is an example of:

a. Inherent risk.

b. Audit risk.

c. Control risk.

d. Failure risk.

The core of the information processing architecture is the:

a. Organizations data.

b. Mainframe communications.

c. Mainframe computer.

d. Servers.

Key controls to mitigate risk are tested in order to determine the risk is being controlled in a manner which is:

a. Adequate and effective.

b. Adequate.

c. At the level specified by management.

d. Effective.

A risk arising external to the organization which calls for a risk position to be taken by the organization is:

a. An influenceable risk.

b. A controllable risk.

c. An uncontrollable risk.

d. A strategic risk.

Risk mitigation can be achieved by any of the following except:

a. Risk avoidance.

b. Risk elimination.

c. Risk transference.

d. Risk assumption.

In gathering evidence an auditor will:

a. Always use computer assisted audit tools and techniques.

b. Use whichever tools and techniques are appropriate for the audit.

c. Use the same audit program as last year.

d. Design an audit program and follow it exactly.