Planning an Audit

A.

The IS auditor's first activity when planning an audit should be to gain an understanding of the area to be audited. Therefore, the correct answer is A.

Here's a more detailed explanation:

A. Gain an understanding of the area to be audited: This involves gathering information about the auditable area, such as its purpose, functions, processes, systems, and risks. The auditor should also identify the key stakeholders, internal and external regulations and standards, and the scope and objectives of the audit. This understanding will help the auditor to design an appropriate audit approach, determine the audit criteria, and assess the level of risk and materiality.

B. Document specific questions in the audit program: This is a subsequent step after gaining an understanding of the area to be audited. Once the auditor has identified the audit criteria and objectives, they can develop a set of specific audit questions or procedures to test the controls and processes. These questions will be documented in the audit program, which is a roadmap for the audit process.

C. Create a list of key controls to be reviewed: This is also a subsequent step after gaining an understanding of the area to be audited. Once the auditor has identified the audit criteria and objectives, they can identify the key controls that mitigate the identified risks. The auditor should then develop a plan to review and test these controls to assess their effectiveness.

D. Identify proper resources for audit activities: This is an important step in planning an audit, but it should come after the auditor has gained an understanding of the area to be audited. The auditor should identify the resources required to carry out the audit, such as staff, tools, and technology. The auditor should also consider any constraints or limitations that may affect the audit's scope, timing, or quality.

In summary, gaining an understanding of the area to be audited should be the IS auditor's first activity when planning an audit. This understanding will help the auditor to design an appropriate audit approach, determine the audit criteria, and assess the level of risk and materiality.