CISA Question of the Day: Materiality Determination in IT Audits

Quiz Yazan Ibrahim

CISA exam practice question — CISA Question of the Day: Materiality Determination in IT Audits

CISA exam practice question: daily practice for the Certified Information Systems Auditor (CISA) exam — domain: Information Systems Auditing Process.

Question

You are planning an IT audit of a payroll application that feeds into financial reporting. To establish the threshold for reportable control deficiencies, which approach is most appropriate for determining materiality for this IT audit engagement?

  • A. Set a fixed monetary threshold based solely on management’s stated tolerance for discrepancies.
  • B. Align materiality with financial-statement materiality and adjust for qualitative factors such as fraud risk, regulatory impact, and user reliance.
  • C. Define materiality as a fixed percentage of the number of transactions processed during the period.
  • D. Escalate all control failures that occur in production and use the count of failures as the primary materiality metric.
Show the answer and explanation

Correct answer: B. Align materiality with financial-statement materiality and adjust for qualitative factors such as fraud risk, regulatory impact, and user reliance.

Option B is best because IT audit materiality should be aligned with overall financial-statement materiality while also incorporating qualitative considerations (fraud risk, regulatory exposure, stakeholder reliance on the system) and the audit’s objectives; the auditor should document the rationale and any adjustments. Option A is wrong because relying solely on management’s tolerance is subjective and may understate risks. Option C is wrong because basing materiality on transaction counts ignores monetary significance and qualitative impacts. Option D is wrong because raw failure counts do not reflect the magnitude or significance of potential misstatements or business impact.

Want more practice?

Prepare for the Certified Information Systems Auditor (CISA) exam with IT Department Audit: Risk, IT Control and Governance Evaluation.