CISA Practice Test 18 — 15 Questions

Question 1

An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?

Accepted Answer

Greater reliance on detective and compensating controls. In small organizations, segregation of duties may be limited, so the auditor should place greater reliance on detective and compensating controls.

Answer

Reduced audit scope because of limited staff

Answer

Increased reliance on preventive controls due to limited staff

Answer

Use of extensive substantive testing to compensate for weak controls

Question 2

Which of the following is a key difference between an internal audit and an external audit?

Accepted Answer

Internal auditors are employees of the organization, which may affect independence.. Internal auditors are employees of the organization, which may create independence concerns, while external auditors are independent third parties.

Answer

External audits are always required by law, while internal audits are voluntary.

Answer

External auditors issue a report to management, while internal auditors report to the board.

Answer

Internal audits focus only on financial controls.

Question 3

In the audit follow-up phase, which TWO actions are essential? (Select two.)

Accepted Answer

Assess the effectiveness of the corrective actions. Follow-up includes verifying that management has implemented corrective actions and assessing their effectiveness.

Answer

Expand the scope of the original audit

Answer

Re-issue the audit report

Answer

Update the audit program for next year

Question 4

Which of the following audit types is most likely to be conducted by an employee of the organization being audited, potentially raising independence concerns?

Accepted Answer

Internal audit. Internal audits are performed by employees of the organization, which can create independence issues. External audits are conducted by third parties.

Answer

IS audit

Answer

Compliance audit

Answer

External audit

Question 5

During an audit, the IS auditor identifies that the audit team lacks the technical expertise to evaluate a specific system. According to ISACA standards, the auditor should:

Accepted Answer

Engage a subject matter expert with the required skills. If the audit team lacks necessary expertise, the auditor should engage a specialist or subject matter expert to ensure audit quality.

Answer

Skip the evaluation of that system

Answer

Request management to provide training

Answer

Proceed with the audit and document the limitation

Question 6

Which THREE factors should an IS auditor consider when determining the sample size for a compliance test? (Select three.)

Accepted Answer

The tolerable error rate. Sample size is influenced by desired confidence, tolerable error rate, and expected error rate.

Answer

The audit budget

Answer

The population size

Question 7

An IS auditor is assessing the effectiveness of controls over a critical financial system. Which TWO types of evidence provide the highest level of assurance? (Select TWO.)

Accepted Answer

Re-performance. Re-performance and observation provide direct evidence; re-performance shows the control works, and observation provides witness of execution.

Answer

Inquiry

Answer

Inspection of documentation

Answer

Analytical procedures

Question 8

An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?

Accepted Answer

Comparing current-year expenses to prior-year expenses. Analytical procedures involve comparisons of data to expectations, such as comparing current-year data to prior-year data to identify unusual fluctuations.

Answer

Observing the inventory count

Answer

Inspecting authorization forms for signatures

Answer

Confirming account balances with third parties

Question 9

According to ISACA audit standards, which TWO of the following are phases of the audit process? (Select two.)

Accepted Answer

Reporting. The standard audit process phases are planning, fieldwork, reporting, and follow-up. Risk assessment is part of planning, and testing is part of fieldwork.

Answer

Documentation

Answer

Testing

Answer

Risk assessment

Question 10

An organization's IT security policy requires that all employees complete annual security awareness training. An auditor notes that completion rate is only 60%. What is the MOST effective way to monitor compliance?

Accepted Answer

Implement a learning management system that tracks completions and generates reports. Automated tracking and reporting provides objective evidence of compliance and enables follow-up.

Answer

Review training records manually each quarter

Answer

Require managers to confirm their staff's completion

Answer

Conduct surprise audits of employee knowledge

Question 11

An organization is implementing ITIL 4. Which TWO of the following are part of the four dimensions of service management? (Select TWO.)

Accepted Answer

Organizations and People. ITIL 4 defines four dimensions: organizations and people, information and technology, partners and suppliers, value streams and processes.

Answer

Governance

Answer

Financial Management

Answer

Service Level Management

Question 12

When an organization uses an external provider to manage its IT help desk, this is an example of which sourcing model?

Accepted Answer

Outsourcing. Outsourcing involves contracting with an external provider to manage specific IT functions.

Answer

Cloud services

Answer

Insourcing

Answer

Co-sourcing

Question 13

In a RACI matrix for the change management process, who is typically Accountable for the overall change process?

Accepted Answer

The change manager. The change manager is typically Accountable for the change management process, ensuring it is effective and compliant.

Answer

The change requester

Answer

The system owner

Answer

The IT director

Question 14

An IS auditor is reviewing a vendor's SOC 2 report as part of a systems acquisition. Which TWO aspects should the auditor verify to ensure the report is reliable?

Accepted Answer

The report was issued within the last 12 months. The auditor must ensure the SOC 2 report is from a qualified auditor and covers the relevant period for the current evaluation.

Answer

The report includes a description of the vendor's business continuity plan

Answer

The report includes a list of the vendor's customers

Answer

The report contains the vendor's internal control objectives

Question 15

Which TWO of the following are benefits of an iterative SDLC approach compared to waterfall? (Select two.)

Accepted Answer

Early and frequent feedback from stakeholders. Iterative approaches allow early feedback and adaptability to changing requirements, unlike waterfall's rigid sequential phases.

Answer

Simpler documentation requirements

Answer

Predictable project timeline

Answer

Reduced need for user involvement