Exam CISA topic 1 question 1741 discussion

The scenario describes a situation where a major issue arose from weaknesses that were not within the audit scope. This indicates a failure to identify and assess the risks associated with those out-of-scope areas during the initial audit planning phase. CISA manual 28th edition defines inherent risk as "the risk level or exposure assessed without considering the actions that management has taken or might take." In the context of audit planning, overlooking potential weaknesses responsible for a major issue, which were subsequently excluded from the audit scope, suggests an inadequate initial assessment of the inherent risks associated with the system implementation. Had a comprehensive inherent risk assessment been performed, these high-risk areas might have been identified and included within the audit's scope.

Detection risk refers to the risk that auditors fail to detect material misstatements or weaknesses in an audit. In this scenario, the audit scope did not cover the weaknesses responsible for a major issue, meaning the auditors did not identify critical problems. This aligns with detection risk, which occurs when audit procedures are insufficient or incorrectly designed to uncover significant risks.