CISA Practice Test 15 — 15 Questions

Question 1

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

Accepted Answer

The risk assessment of the area under review. The scope should be based on a risk assessment to ensure that the audit addresses areas with the highest risk to the organization.

Answer

The availability of audit staff

Answer

The budget approved for the audit

Answer

The results of prior audit findings

Question 2

An IS auditor identifies a control deficiency that could result in a material misstatement in the financial statements. According to audit reporting standards, this should be classified as:

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

Finding

Answer

Deficiency

Answer

Observation

Question 3

Which of the following is the best example of audit evidence obtained through re-performance?

Accepted Answer

Recalculating the total of a control report to verify accuracy. Re-performance involves the auditor independently executing a control to verify its effectiveness. The auditor recalculating a control total is a direct re-performance.

Answer

Reviewing log files for unauthorized access attempts

Answer

Interviewing the system administrator about backup procedures

Answer

Observing employees as they process transactions

Question 4

Which of the following is a permanent file item in an IS audit working paper?

Accepted Answer

Organizational chart of the IT department. The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts. Current year's audit program is part of the current file.

Answer

Confirmation letters from vendors

Answer

Current year's audit program

Answer

List of audit findings for the current year

Question 5

Which of the following evidence types involves the auditor independently performing a control procedure to verify its effectiveness?

Accepted Answer

Re-performance. Re-performance is when the auditor independently executes a control to confirm it operates as designed.

Answer

Inspection

Answer

Observation

Answer

Inquiry

Question 6

An IS auditor is planning an audit of a decentralized organization with multiple business units. The auditor wants to use a risk-based approach. Which of the following is the MOST appropriate factor to prioritize audit coverage?

Accepted Answer

The results of a risk assessment evaluating inherent risk and control effectiveness.. Risk assessment should consider the inherent risk of each unit, including financial impact, complexity, and past issues, to prioritize high-risk areas.

Answer

The geographical location of each business unit.

Answer

The budget allocated to each business unit for IT.

Answer

The number of employees in each business unit.

Question 7

An IS auditor is performing a risk assessment for an audit of a cloud service provider. Which THREE factors should be considered when assessing inherent risk? (Select THREE.)

Accepted Answer

Complexity of the cloud architecture. Inherent risk is the risk without controls. Factors include complexity, data sensitivity, and changes in the environment.

Answer

Effectiveness of monitoring controls

Answer

Strength of access controls

Question 8

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Accepted Answer

Complexity of transactions. Inherent risk is the susceptibility to misstatement before considering controls. Complexity of transactions and volume of transactions increase inherent risk. Control effectiveness is part of control risk, and auditor experience relates to detection risk.

Answer

Auditor's experience with similar systems

Answer

Results of prior audits

Answer

Effectiveness of internal controls

Question 9

An IS auditor uses statistical sampling to test a population of 10,000 transactions. The auditor discovers 5 errors in the sample of 200. Which of the following conclusions is most appropriate?

Accepted Answer

The population error rate is likely between 1% and 4% at a given confidence level. Based on sample results, the error rate is 2.5%, which can be projected to the population with a confidence level.

Answer

The population error rate is exactly 2.5%

Answer

The population has a material weakness

Answer

The population error rate is 5%

Question 10

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Accepted Answer

Re-performance of access provisioning using a test account. Re-performance and inspection of audit logs provide direct evidence of control effectiveness.

Answer

Inquiry of the security administrator

Answer

Inspection of user access review documentation

Answer

Observation of access request processing

Question 11

During an operational audit of an IT department, the auditor finds that system uptime is 99.9% but the department missed two critical project deadlines. Which conclusion is most appropriate?

Accepted Answer

The department is efficient but may not be effective. Operational audit assesses effectiveness and efficiency; missed deadlines indicate inefficiency or ineffectiveness.

Answer

The department has a material weakness in controls

Answer

The department is operating effectively based on uptime

Answer

The department should be outsourced

Question 12

An IS auditor is testing the effectiveness of a control that requires dual authorization for all transactions over $10,000. The population consists of 5,000 transactions, of which 250 exceed the threshold. The auditor uses a sample of 50 transactions from the entire population and finds 3 exceptions. What type of sampling method did the auditor use?

Accepted Answer

Judgmental sampling. The auditor selected a sample from the entire population without stratification, and the selection method is not described as random or systematic; however, the description implies a non-statistical judgmental sample. Stratified sampling would require dividing the population into subgroups (e.g., by value).

Answer

Stratified sampling

Answer

Random sampling

Answer

Systematic sampling

Question 13

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. Which of the following actions should the auditor prioritize?

Accepted Answer

Include a review of the ERP system in the audit scope due to the high inherent risk. A risk-based audit approach requires focusing on high-risk areas. A new ERP system introduces significant risks, so it should be prioritized in the audit scope.

Answer

Exclude the ERP system from the audit scope because it is new and not yet stable

Answer

Delay the audit until the ERP system has been fully stabilized for six months

Answer

Focus only on financial reporting controls related to the ERP system

Question 14

Which of the following is a key difference between internal and external IS auditors?

Accepted Answer

External auditors are required for regulatory compliance.. External auditors are independent third parties, while internal auditors are employees. Independence is a key factor in objectivity and reliability of audit work.

Answer

Internal auditors perform only operational audits.

Answer

External auditors cannot perform compliance audits.

Answer

Internal auditors have greater independence.

Question 15

During a risk-based audit, the IS auditor identifies a control deficiency that could lead to a material misstatement in financial reporting. According to standard classification, this is best described as a:

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

Observation

Answer

Deficiency

Answer

Finding