CISA Information System Auditing Process — 30 Questions

Question 1

Which of the following audit types is MOST likely to be performed by an organization's own employees?

Accepted Answer

Internal audit. Internal audits are conducted by employees of the organization, providing deep knowledge but raising independence concerns.

Answer

External audit

Answer

IS audit

Answer

Compliance audit

Question 2

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Accepted Answer

Fieldwork. Fieldwork is the phase where audit procedures are executed to gather evidence.

Answer

Follow-up

Answer

Reporting

Answer

Planning

Question 3

An IS auditor is planning an audit of a financial system. The auditor identifies that the inherent risk is high due to the complexity of transactions, but control risk is low because of strong automated controls. Which component of audit risk will be MOST affected by the auditor's testing strategy?

Accepted Answer

Detection risk. Detection risk is the risk that audit procedures fail to detect material misstatements. With low control risk, the auditor may rely on controls and reduce substantive testing, affecting detection risk.

Answer

Inherent risk

Answer

Control risk

Answer

Audit risk

Question 4

Which type of audit evidence involves the auditor independently performing a control procedure to verify its effectiveness?

Accepted Answer

Re-performance. Re-performance is when the auditor independently executes a control to confirm it operates as intended.

Answer

Inspection

Answer

Observation

Answer

Inquiry

Question 5

In a risk-based audit approach, which of the following BEST describes how an IS auditor should prioritize audit coverage?

Accepted Answer

Allocate more audit resources to areas with higher risk and lower control effectiveness. A risk-based approach focuses on areas with higher inherent risk and weaker controls to maximize effectiveness.

Answer

Focus on areas where management has requested review

Answer

Concentrate solely on areas with the highest inherent risk

Answer

Focus equally on all areas of the audited entity

Question 6

An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?

Accepted Answer

Random sampling. Statistical random sampling gives every item an equal probability of selection.

Answer

Stratified sampling

Answer

Systematic sampling

Answer

Judgmental sampling

Question 7

Which document is typically included in the permanent file of audit documentation?

Accepted Answer

Organizational chart. The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts.

Answer

Management representation letter

Answer

Current year audit program

Answer

Working papers for testing

Question 8

During an operational audit, the auditor uses ratio analysis to compare current year expenses to prior years and industry benchmarks. This is an example of which type of audit evidence?

Accepted Answer

Analytical procedures. Analytical procedures involve evaluations of financial information through analysis of plausible relationships.

Answer

Inquiry

Answer

Observation

Answer

Inspection

Question 9

An IS auditor identifies a control deficiency that could result in a material misstatement in the financial statements. According to audit reporting standards, this should be classified as:

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

Finding

Answer

Deficiency

Answer

Observation

Question 10

Which of the following is a key difference between internal and external auditors?

Accepted Answer

External auditors are more independent than internal auditors. External auditors are independent third parties, while internal auditors are employees of the organization.

Answer

Internal auditors are required for regulatory compliance

Answer

Internal auditors focus only on financial controls

Answer

External auditors have deeper organizational knowledge

Question 11

What is the primary purpose of the planning phase in an IS audit?

Accepted Answer

To identify risks and define audit scope. Planning ensures the audit is focused on high-risk areas and resources are allocated appropriately.

Answer

To execute audit tests

Answer

To issue the final report

Answer

To follow up on findings

Question 12

An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?

Accepted Answer

Observation and re-performance. Observation (watching) and re-performance (doing) are both used to test control effectiveness.

Answer

Inquiry and inspection

Answer

Inspection and observation

Answer

Analytical procedures and inquiry

Question 13

Which of the following is a characteristic of non-statistical (judgmental) sampling?

Accepted Answer

The auditor uses professional judgment to select sample items. Non-statistical sampling relies on the auditor's judgment and does not use probability theory.

Answer

Every item has an equal chance of selection

Answer

The sample size is determined using statistical formulas

Answer

The sample results can be projected to the population with known confidence

Question 14

During the follow-up phase of an audit, the auditor discovers that a previous finding has not been remediated. What is the auditor's BEST course of action?

Accepted Answer

Report the lack of remediation to senior management. If remediation has not occurred, the auditor should escalate the issue to management to ensure action is taken.

Answer

Perform additional testing to confirm the finding

Answer

Ignore the finding since it was previously reported

Answer

Close the finding as accepted risk

Question 15

An IS auditor is assessing audit risk for a payroll system. The inherent risk is assessed as moderate, control risk as high due to weak segregation of duties, and detection risk is set at low because of extensive substantive testing. What is the impact on overall audit risk?

Accepted Answer

Moderate to high. Audit risk = inherent risk × control risk × detection risk. With high control risk and low detection risk, audit risk is moderate to high.

Answer

Cannot be determined without more information

Answer

Low because detection risk is low

Answer

Very low because all risks are low

Question 16

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Accepted Answer

Testing controls. Fieldwork involves executing audit procedures; walkthroughs and testing controls are part of fieldwork.

Answer

Defining audit scope

Answer

Developing the audit program

Answer

Issuing the draft report

Question 17

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

Answer

General

Answer

Subjective

Question 18

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Accepted Answer

Ratio analysis. Analytical procedures include ratio analysis and trend analysis; inquiry and inspection are other types.

Answer

Inquiry of management

Answer

Inspection of documents

Answer

Observation of process

Question 19

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

Accepted Answer

It focuses audit efforts on areas with the highest risk.. A risk-based approach allows the auditor to focus on areas with higher risk, thereby optimizing the use of audit resources and ensuring that significant risks are addressed.

Answer

It ensures that all controls are tested equally.

Answer

It reduces the overall cost of the audit.

Answer

It guarantees the detection of material misstatements.

Question 20

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Accepted Answer

A material weakness. A material weakness is a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

An observation

Answer

A deficiency

Answer

A finding