CISA Practice Test 16 — 15 Questions

Question 1

An auditor is selecting a sample of purchase orders for testing. The auditor decides to select every 50th purchase order from a list. This is an example of:

Accepted Answer

Systematic sampling. Systematic sampling selects items at a fixed interval (every nth item).

Answer

Judgmental sampling

Answer

Random sampling

Answer

Stratified sampling

Question 2

A multinational corporation's IT audit reveals that the IT department uses a single instance of an ERP system for all subsidiaries. Which COBIT 2019 governance system component is MOST relevant to address the risks of this centralized approach?

Accepted Answer

Policies. COBIT 2019 emphasizes policies as a governance component to define rules for consistency and control across the organization.

Answer

Principles

Answer

Culture, Ethics, and Behavior

Answer

Organizational Structures

Question 3

Which of the following best describes the primary advantage of using statistical sampling over non-statistical sampling in an IS audit?

Accepted Answer

It provides a basis for quantifying sampling risk and projecting results to the population.. Statistical sampling allows the auditor to quantify sampling risk and project results to the population with a measurable confidence level, unlike non-statistical sampling.

Answer

It is more effective for detecting fraud than non-statistical sampling.

Answer

It ensures that all items in the population are tested.

Answer

It requires less auditor judgment and is easier to apply.

Question 4

Which of the following is an example of a compliance audit?

Accepted Answer

Evaluating whether IT controls meet SOX requirements. Compliance audits verify adherence to laws, regulations, and policies.

Answer

Assessing the performance of a new system

Answer

Reviewing the efficiency of a production line

Answer

Analyzing financial statement ratios

Question 5

An external auditor is conducting a compliance audit for a company subject to SOX. Which standard is most relevant for this engagement?

Accepted Answer

GAAS. GAAS (Generally Accepted Auditing Standards) are relevant for external audits, including compliance audits.

Answer

IIA Standards

Answer

ISACA IT Audit Standards

Answer

COBIT

Question 6

An IS auditor is performing a walkthrough of a purchase-to-pay process. Which of the following is the auditor most likely trying to achieve?

Accepted Answer

Understand the process and identify controls. A walkthrough helps the auditor understand the process flow and identify controls in place.

Answer

Gather evidence for audit findings

Answer

Test the effectiveness of controls

Answer

Verify the accuracy of transaction data

Question 7

An IS auditor is assessing the risk of a new financial application. The auditor determines that inherent risk is high due to complex transactions, but control risk is low because of strong automated controls. If detection risk is set at 5%, what is the audit risk?

Accepted Answer

0.8%. Audit risk = Inherent risk × Control risk × Detection risk. Assuming inherent risk = 80%, control risk = 20%, detection risk = 5%, audit risk = 0.8 × 0.2 × 0.05 = 0.008 = 0.8%.

Answer

8.0%

Answer

1.0%

Answer

5.0%

Question 8

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

Accepted Answer

To gain an understanding of the process and identify control points. A walkthrough helps the auditor understand the flow of transactions and identify control points, which aids in assessing control design and identifying risks.

Answer

To test the operating effectiveness of controls

Answer

To collect evidence of control failures

Answer

To identify process owners and key personnel

Question 9

During the fieldwork phase, an IS auditor discovers that a control is not operating as designed. The auditor reperforms the control and finds that it is effective. Which of the following conclusions is MOST appropriate?

Accepted Answer

The control is operating effectively based on the re-performance.. If the auditor's independent re-performance shows the control is effective, the control is operating effectively, despite the initial indication of a deviation.

Answer

The control design is adequate but implementation is weak.

Answer

The re-performance is not sufficient; additional testing is required.

Answer

The control is not operating effectively because the design was not followed.

Question 10

Which TWO of the following are types of statistical sampling methods? (Select TWO.)

Accepted Answer

Stratified sampling. Stratified sampling and systematic sampling are both statistical methods that use random selection.

Answer

Block sampling

Answer

Haphazard sampling

Answer

Judgmental sampling

Question 11

Which of the following is the most reliable form of audit evidence?

Accepted Answer

Re-performance of a control by the auditor. Re-performance is the most reliable because the auditor independently performs the control, obtaining direct evidence. Observation is less reliable because the auditor may influence behavior.

Answer

Inquiry of management about a control

Answer

Observation of a control being performed

Answer

Inspection of signed approval forms

Question 12

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Accepted Answer

Fieldwork. Fieldwork is the phase where audit procedures are executed to gather evidence.

Answer

Follow-up

Answer

Reporting

Answer

Planning

Question 13

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

Accepted Answer

Material weakness. A deficiency that could result in a material misstatement is classified as a material weakness.

Answer

Deficiency

Answer

Observation

Answer

Finding

Question 14

An IS auditor is reviewing the audit documentation from a prior year and finds that a material weakness was reported but not remediated. According to ISACA standards, which audit phase should address this?

Accepted Answer

Follow-up. Follow-up is the phase dedicated to verifying that management has implemented corrective actions for previous findings.

Answer

Reporting

Answer

Fieldwork

Answer

Planning

Question 15

During the follow-up phase of an audit, the auditor discovers that a previous finding has not been remediated. What is the auditor's BEST course of action?

Accepted Answer

Report the lack of remediation to senior management. If remediation has not occurred, the auditor should escalate the issue to management to ensure action is taken.

Answer

Perform additional testing to confirm the finding

Answer

Ignore the finding since it was previously reported

Answer

Close the finding as accepted risk