CISA Information System Auditing Process — 20 Questions

Question 1

An IS auditor is assessing audit risk for a payroll system. The inherent risk is assessed as moderate, control risk as high due to weak segregation of duties, and detection risk is set at low because of extensive substantive testing. What is the impact on overall audit risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Moderate to high. Audit risk = inherent risk × control risk × detection risk. With high control risk and low detection risk, audit risk is moderate to high.

Answer

Cannot be determined without more information

Answer

Low because detection risk is low

Answer

Very low because all risks are low

Question 2

An IS auditor is selecting audit procedures to test controls over user access. Which of the following is an example of a re-performance procedure?

Accepted Answer

Independently creating a test user account and verifying access rights. Re-performance involves the auditor independently performing a control to verify its effectiveness. For access controls, independently adding a test user and verifying access rights is a re-performance.

Answer

Observing the security administrator adding a user

Answer

Reviewing the access control policy document

Answer

Interviewing the security administrator about the process

Question 3

During the fieldwork phase, an IS auditor discovers that a control is not operating as designed. The auditor reperforms the control and finds that it is effective. Which of the following conclusions is MOST appropriate?

Accepted Answer

The control is operating effectively based on the re-performance.. Re-performance is a substantive audit procedure that provides direct evidence of a control's operating effectiveness. When the auditor independently executes the control and finds it effective, this evidence supersedes the initial observation of deviation, which may have been an isolated instance or due to the auditor's earlier misunderstanding. Therefore, the most appropriate conclusion is that the control is operating effectively based on the re-performance.

Answer

The control design is adequate but implementation is weak.

Answer

The re-performance is not sufficient; additional testing is required.

Answer

The control is not operating effectively because the design was not followed.

Question 4

Which of the following is a key difference between internal and external IS auditors?

Accepted Answer

External auditors are required for regulatory compliance.. External auditors are often required by regulators (e.g., SEC, banking regulators) to provide independent assurance on financial statements and compliance, making regulatory compliance a key driver for their engagement. Internal auditors, while independent within the organization, report to management/audit committee and focus on internal control and risk management. The distinction lies in the external auditor's mandated role in regulatory compliance attestation.

Answer

Internal auditors perform only operational audits.

Answer

External auditors cannot perform compliance audits.

Answer

Internal auditors have greater independence.

Question 5

An IS auditor is assessing the effectiveness of controls over a critical financial system. Which TWO types of evidence provide the highest level of assurance? (Select TWO.)

Accepted Answer

Re-performance. Re-performance (A) provides the highest level of assurance because the auditor independently executes the control or procedure and directly verifies the result, eliminating reliance on the assertions of others. Observation (D) is also a strong evidence type because the auditor witnesses the control being performed in real time, confirming that it exists and operates as described. Together, these two types give direct, first-hand evidence of control effectiveness rather than indirect or corroborative evidence. Inquiry (B) only yields verbal or written representations from personnel and must be corroborated, so it provides low assurance. Inspection of documentation (C) is limited to the records provided and does not prove the control actually operated. Analytical procedures (E) are useful for identifying anomalies or trends but do not directly test the operating effectiveness of a specific control.

Answer

Inquiry

Answer

Inspection of documentation

Answer

Analytical procedures

Question 6

Which TWO of the following are components of audit risk in the ISACA risk model? (Select TWO.)

Accepted Answer

Inherent risk. In the ISACA risk model, audit risk is composed of inherent risk (A) and detection risk (D). Inherent risk (A) is the risk that a material error or control weakness exists in the audited area before any audit procedures are performed, reflecting the nature of the business, its processes, and its environment. Detection risk (D) is the risk that the auditor's procedures fail to detect a material error or weakness that exists, which the auditor can influence by designing and executing appropriate tests. Together, these two components define the overall audit risk that an auditor may issue an incorrect opinion. Engagement risk (B) relates to the auditor's exposure to loss or damage from the engagement itself, not a component of audit risk. Sampling risk (C) is a subset of detection risk arising from testing a sample rather than the entire population, not a separate top-level component. Business risk (E) concerns threats to the organization's objectives and operations, not the auditor's risk model.

Answer

Engagement risk

Answer

Sampling risk

Answer

Business risk

Question 7

An IS auditor is testing the effectiveness of a control that requires dual authorization for all transactions over $10,000. The population consists of 5,000 transactions, of which 250 exceed the threshold. The auditor uses a sample of 50 transactions from the entire population and finds 3 exceptions. What type of sampling method did the auditor use?

Accepted Answer

Judgmental sampling. Judgmental sampling is correct because the auditor selected 50 transactions from the entire population without using a statistical (probabilistic) method — the sample was chosen based on the auditor's professional judgment rather than random selection. The key indicator is that the auditor did not stratify the population (which would have separated the 250 high-value transactions) nor apply a random/systematic selection technique. When an auditor hand-picks or judgmentally determines sample items without a mathematical selection basis, it is judgmental (non-statistical) sampling.

Answer

Stratified sampling

Answer

Random sampling

Answer

Systematic sampling

Question 8

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

Accepted Answer

Performing trend analysis on the number of transactions processed per hour. Efficiency in a data entry process is best measured by throughput and productivity metrics, and trend analysis on transactions processed per hour directly quantifies output over time, revealing efficiency gains or degradation. This is a quantitative, process-performance-oriented procedure that matches the audit objective. The other options address access control, procedural observation, or error rates — none of which directly measure efficiency.

Answer

Inspecting system logs to verify user access

Answer

Observing data entry operators to identify procedural bottlenecks

Answer

Interviewing the data entry supervisor about error rates

Question 9

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

Accepted Answer

Low. Audit risk is determined by inherent risk, control risk, and detection risk. The standard audit risk model is: Audit Risk = Inherent Risk × Control Risk × Detection Risk. With inherent risk high, control risk moderate, and detection risk low, the product is low (e.g., High × Moderate × Low = Low). This indicates a low overall audit risk because the auditor plans to perform sufficient substantive procedures to compensate for the high inherent and moderate control risks.

Answer

Moderate

Answer

High

Answer

Cannot be determined

Question 10

During a risk-based audit, the IS auditor identifies a control deficiency that could lead to a material misstatement in financial reporting. According to standard classification, this is best described as a:

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. Since the scenario specifies a control deficiency that could lead to a material misstatement, it meets the definition of a material weakness. This is the most severe classification and is specifically defined in auditing standards (e.g., PCAOB AS 2201, SOX 404).

Answer

Observation

Answer

Deficiency

Answer

Finding

Question 11

An IS auditor is performing a walkthrough of a purchase-to-pay process. The auditor selects a sample of purchase orders and traces them through the system to verify that controls are properly designed and implemented. This is an example of:

Accepted Answer

Walkthrough. A walkthrough involves tracing a transaction through the entire process to confirm understanding and assess control design. It combines inquiry, observation, and inspection.

Answer

Analytical procedure

Answer

Test of controls

Answer

Substantive testing

Question 12

According to ISACA audit standards, which TWO of the following are phases of the audit process? (Select two.)

Accepted Answer

Reporting. Option A (Reporting) is correct because ISACA's IT audit process includes reporting as a distinct phase, in which the auditor communicates findings, conclusions, and recommendations to management and the audit committee through the audit report. Option C (Planning) is correct because planning is the initial phase of the ISACA audit process, covering engagement scope, objectives, risk assessment, resource allocation, and development of the audit program. The other options do not belong: Documentation (B) is an ongoing activity performed throughout the audit rather than a separate phase, Testing (D) is a set of procedures executed within the execution/fieldwork phase, and Risk assessment (E) is an activity performed during planning (and used to prioritize audit work), not a standalone phase of the audit process.

Answer

Documentation

Answer

Testing

Answer

Risk assessment

Question 13

An IS auditor finds that a control deficiency could lead to a material misstatement if combined with another deficiency. How should this be classified?

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination, that results in a reasonable possibility of material misstatement.

Answer

Deficiency

Answer

Observation

Answer

Significant deficiency

Question 14

Which THREE factors should an IS auditor consider when determining the sample size for a compliance test? (Select three.)

Accepted Answer

The tolerable error rate. The tolerable error rate (A) is correct because it defines the maximum deviation from the control that the auditor is willing to accept while still concluding the control is effective, and a lower tolerable rate requires a larger sample. The confidence level desired (B) is correct because it reflects how certain the auditor must be that the sample result represents the population, and higher confidence demands a larger sample size. The expected error rate in the population (C) is correct because a higher anticipated deviation rate increases the sample size needed to detect it, and it is typically derived from prior audits or a pilot sample. The audit budget (D) is not a statistically valid determinant of sample size, since resource constraints should not drive the evidential sufficiency of a compliance test. The population size (E) is not one of the three primary factors in attribute sampling for compliance testing, as it has minimal effect on sample size once the population is large.

Answer

The audit budget

Answer

The population size

Question 15

Which of the following is the PRIMARY purpose of audit working papers?

Accepted Answer

To support the auditor's conclusions and provide evidence of the work performed.. The primary purpose of audit working papers is to support the auditor's conclusions and provide evidence that the audit was performed in accordance with professional standards. Working papers document the audit procedures performed, the evidence obtained, and the conclusions reached, forming the basis for the audit report. They also enable review by supervisors and provide a defense if the audit is challenged.

Answer

To provide a permanent record of the organization's financial transactions.

Answer

To serve as a basis for the audit fee calculation.

Answer

To replace the need for management's representation letter.

Question 16

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

Accepted Answer

The control is effective as the sample deviation rate is below the tolerable rate.. The sample deviation rate of 4% (2 out of 50) is below the tolerable deviation rate of 5%. Therefore, the control is considered effective based on the sample evidence. The auditor does not need to increase the sample size unless the deviation rate is close to the tolerable rate or other risk factors exist. In this case, the control can be relied upon as designed.

Answer

The auditor should increase the sample size to reduce sampling risk.

Answer

The control is ineffective because deviations were found.

Answer

The auditor should conclude that the control is ineffective and report a deficiency.

Question 17

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

Accepted Answer

Material weakness. A deficiency that could lead to unauthorized modification of financial data, with no compensating control, represents a material weakness because it could result in material misstatement of financial statements. Material weakness is the most severe classification, indicating a significant deficiency or combination of deficiencies that results in a reasonable possibility of material misstatement. The auditor should classify it as such.

Answer

Deficiency

Answer

Observation

Answer

Finding

Question 18

Which of the following best describes audit risk in the context of an IS audit?

Accepted Answer

Risk that the auditor will issue an incorrect opinion.. Audit risk is defined as the risk that the auditor will issue an incorrect opinion (option C). Option B represents the audit risk model (Inherent risk × Control risk × Detection risk), which is a formula for assessing audit risk, not the definition itself. Therefore, C is the best description.

Answer

Risk that a material misstatement exists.

Answer

Inherent risk × Control risk × Detection risk

Answer

Risk that controls will not prevent or detect errors.

Question 19

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

Accepted Answer

Re-performance. Re-performance involves the auditor independently executing the control to verify its effectiveness.

Answer

Inquiry

Answer

Observation

Answer

Inspection

Question 20

During an audit, the auditor identifies a control deficiency that could result in a material misstatement. According to ISACA guidelines, this is classified as:

Accepted Answer

Material weakness. A material weakness is a deficiency that could result in a material misstatement.

Answer

Finding

Answer

Deficiency

Answer

Observation