CISA Practice Test 17 — 15 Questions

Question 1

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. The audit team has limited experience with this ERP. Which of the following is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Engage an external specialist with ERP expertise to supplement the audit team.. Incorporating an external specialist with ERP expertise ensures the audit is conducted effectively despite the team's lack of experience.

Answer

Limit the audit scope to exclude the new ERP system.

Answer

Proceed with the audit using existing staff and hope for the best.

Answer

Postpone the audit until the team gains sufficient experience.

Question 2

An IT policy exception is requested to allow a legacy system that cannot be patched to remain in operation. What is the BEST way to manage this exception?

Accepted Answer

Approve with compensating controls and a sunset date. Proper exception management requires compensating controls and a time-bound approval with periodic review.

Answer

Reject the request and force the system to be patched

Answer

Escalate to the board for decision

Answer

Approve the exception indefinitely to avoid disruption

Question 3

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Accepted Answer

Ratio analysis. Analytical procedures include ratio analysis and trend analysis; inquiry and inspection are other types.

Answer

Inquiry of management

Answer

Inspection of documents

Answer

Observation of process

Question 4

Which of the following is a characteristic of non-statistical (judgmental) sampling?

Accepted Answer

The auditor uses professional judgment to select sample items. Non-statistical sampling relies on the auditor's judgment and does not use probability theory.

Answer

Every item has an equal chance of selection

Answer

The sample size is determined using statistical formulas

Answer

The sample results can be projected to the population with known confidence

Question 5

Which of the following is the PRIMARY purpose of audit working papers?

Accepted Answer

To support the auditor's conclusions and provide evidence of the work performed.. Working papers document the audit procedures performed, evidence obtained, and conclusions reached, supporting the audit opinion.

Answer

To provide a permanent record of the organization's financial transactions.

Answer

To serve as a basis for the audit fee calculation.

Answer

To replace the need for management's representation letter.

Question 6

An IS auditor is preparing working papers. Which of the following items should be included in the permanent file rather than the current file?

Accepted Answer

Organization chart. The permanent file contains carryforward items like organizational charts and key contracts.

Answer

Audit programme for the current year

Answer

Testing results from current audit

Answer

Management responses to current findings

Question 7

Which of the following is the PRIMARY reason an external audit is considered more independent than an internal audit?

Accepted Answer

External auditors are not employees of the organization.. External auditors are third-party and not employees, reducing bias and enhancing independence.

Answer

External auditors follow stricter standards.

Answer

External auditors have more technical expertise.

Answer

External auditors have access to more resources.

Question 8

During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?

Accepted Answer

Investigate the reason for the increase. Analytical procedures identify anomalies; the auditor should investigate the cause before concluding.

Answer

Report the increase as a finding

Answer

Ignore the increase if it is within budget

Answer

Expand the sample size for testing

Question 9

An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?

Accepted Answer

Statistical attribute sampling. Statistical sampling (attribute sampling) is appropriate when the auditor wants to draw a conclusion about the population's error rate with a specified confidence level.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Stratified sampling

Question 10

An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?

Accepted Answer

Random sampling. Statistical random sampling gives every item an equal probability of selection.

Answer

Stratified sampling

Answer

Systematic sampling

Answer

Judgmental sampling

Question 11

What is the primary purpose of the planning phase in an IS audit?

Accepted Answer

To identify risks and define audit scope. Planning ensures the audit is focused on high-risk areas and resources are allocated appropriately.

Answer

To execute audit tests

Answer

To issue the final report

Answer

To follow up on findings

Question 12

An IS auditor is performing a walkthrough of the accounts payable process. Which audit procedure is the auditor primarily executing?

Accepted Answer

Walkthrough. A walkthrough involves tracing a transaction from initiation to completion, often combining inquiry, observation, and inspection.

Answer

Re-performance

Answer

Inquiry

Answer

Observation

Question 13

An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?

Accepted Answer

Test the compensating controls to determine if they adequately mitigate the risk.. Assessing the effectiveness of compensating controls is appropriate to determine if the control deficiency is mitigated.

Answer

Increase the sample size for substantive testing to compensate.

Answer

Immediately report the missing control as a material weakness.

Answer

Ignore the missing control since compensating controls exist.

Question 14

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Accepted Answer

Use a risk-based approach to focus on high-risk areas. A risk-based approach prioritizes areas with highest risk, efficient for limited resources.

Answer

Rely solely on inquiry to reduce workload

Answer

Postpone the audit until more staff are available

Answer

Audit all areas equally to ensure full coverage

Question 15

During an operational audit, the auditor uses ratio analysis to compare current year expenses to prior years and industry benchmarks. This is an example of which type of audit evidence?

Accepted Answer

Analytical procedures. Analytical procedures involve evaluations of financial information through analysis of plausible relationships.

Answer

Inquiry

Answer

Observation

Answer

Inspection