CISA Information System Auditing Process — All Questions With Answers

Question 1easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is MOST likely to be performed by an organization's own employees?

Question 2easymultiple choice

Read the full Information System Auditing Process explanation →

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Question 3mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a financial system. The auditor identifies that the inherent risk is high due to the complexity of transactions, but control risk is low because of strong automated controls. Which component of audit risk will be MOST affected by the auditor's testing strategy?

Question 4mediummultiple choice

Read the full Information System Auditing Process explanation →

Which type of audit evidence involves the auditor independently performing a control procedure to verify its effectiveness?

Question 5hardmultiple choice

Read the full Information System Auditing Process explanation →

In a risk-based audit approach, which of the following BEST describes how an IS auditor should prioritize audit coverage?

Question 6mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?

Question 7easymultiple choice

Read the full Information System Auditing Process explanation →

Which document is typically included in the permanent file of audit documentation?

Question 8mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit, the auditor uses ratio analysis to compare current year expenses to prior years and industry benchmarks. This is an example of which type of audit evidence?

Question 9hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor identifies a control deficiency that could result in a material misstatement in the financial statements. According to audit reporting standards, this should be classified as:

Question 10mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between internal and external auditors?

Question 11easymultiple choice

Read the full Information System Auditing Process explanation →

What is the primary purpose of the planning phase in an IS audit?

Question 12hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?

Question 13mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a characteristic of non-statistical (judgmental) sampling?

Question 14mediummultiple choice

Read the full Information System Auditing Process explanation →

During the follow-up phase of an audit, the auditor discovers that a previous finding has not been remediated. What is the auditor's BEST course of action?

Question 15hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing audit risk for a payroll system. The inherent risk is assessed as moderate, control risk as high due to weak segregation of duties, and detection risk is set at low because of extensive substantive testing. What is the impact on overall audit risk?

Question 16mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Question 17hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Question 18mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Question 19easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

Question 20mediummultiple choice

Read the full Information System Auditing Process explanation →

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Question 21hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?

Question 22mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

Question 23easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is selecting audit procedures to test controls over user access. Which of the following is an example of a re-performance procedure?

Question 24mediummultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

Question 25hardmultiple choice

Read the full Information System Auditing Process explanation →

During the fieldwork phase, an IS auditor discovers that a control is not operating as designed. The auditor reperforms the control and finds that it is effective. Which of the following conclusions is MOST appropriate?

Question 26mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between internal and external IS auditors?

Question 27easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Question 28hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

Question 29mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

Question 30easymultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the IS auditor identifies that the audit team lacks the technical expertise to evaluate a specific system. According to ISACA standards, the auditor should:

Question 31mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?

Question 32hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?

Question 33mediummultiple choice

Read the full Information System Auditing Process explanation →

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Question 34mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the effectiveness of controls over a critical financial system. Which TWO types of evidence provide the highest level of assurance? (Select TWO.)

Question 35hardmulti select

Read the full Information System Auditing Process explanation →

An IS auditor is performing a risk assessment for an audit of a cloud service provider. Which THREE factors should be considered when assessing inherent risk? (Select THREE.)

Question 36easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are components of audit risk in the ISACA risk model? (Select TWO.)

Question 37easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is most likely to be conducted by an employee of the organization being audited, potentially raising independence concerns?

Question 38mediummultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. Which of the following actions should the auditor prioritize?

Question 39hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing the effectiveness of a control that requires dual authorization for all transactions over $10,000. The population consists of 5,000 transactions, of which 250 exceed the threshold. The auditor uses a sample of 50 transactions from the entire population and finds 3 exceptions. What type of sampling method did the auditor use?

Question 40mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the best example of audit evidence obtained through re-performance?

Question 41easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Question 42mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

Question 43hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

Question 44mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a permanent file item in an IS audit working paper?

Question 45easymultiple choice

Read the full Information System Auditing Process explanation →

A compliance audit is primarily concerned with:

Question 46mediummultiple choice

Read the full Information System Auditing Process explanation →

During a risk-based audit, the IS auditor identifies a control deficiency that could lead to a material misstatement in financial reporting. According to standard classification, this is best described as a:

Question 47hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of a purchase-to-pay process. The auditor selects a sample of purchase orders and traces them through the system to verify that controls are properly designed and implemented. This is an example of:

Question 48mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the most reliable form of audit evidence?

Question 49mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Question 50hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)

Question 51easymulti select

Read the full Information System Auditing Process explanation →

According to ISACA audit standards, which TWO of the following are phases of the audit process? (Select two.)

Question 52easymultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, which of the following is the PRIMARY purpose of conducting a risk assessment?

Question 53mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of a purchase-to-pay process. Which of the following is the auditor most likely trying to achieve?

Question 54mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following types of audit evidence provides the highest level of assurance?

Question 55hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor uses statistical sampling to test a population of 10,000 transactions. The auditor discovers 5 errors in the sample of 200. Which of the following conclusions is most appropriate?

Question 56easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY reason for an external IS audit to be more independent than an internal audit?

Question 57mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit of an IT department, the auditor finds that system uptime is 99.9% but the department missed two critical project deadlines. Which conclusion is most appropriate?

Question 58mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of audit working papers?

Question 59hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?

Question 60easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is an example of a compliance audit?

Question 61mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Question 62hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor finds that a control deficiency could lead to a material misstatement if combined with another deficiency. How should this be classified?

Question 63mediummultiple choice

Read the full Information System Auditing Process explanation →

During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?

Question 64mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Question 65hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE factors should an IS auditor consider when determining the sample size for a compliance test? (Select three.)

Question 66mediummulti select

Read the full Information System Auditing Process explanation →

In the audit follow-up phase, which TWO actions are essential? (Select two.)

Question 67easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Question 68mediummultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. The audit team has limited experience with this ERP. Which of the following is the BEST course of action?

Question 69hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?

Question 70easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of audit working papers?

Question 71mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

Question 72mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the BEST example of an analytical procedure used during an IS audit?

Question 73hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a decentralized organization with multiple business units. The auditor wants to use a risk-based approach. Which of the following is the MOST appropriate factor to prioritize audit coverage?

Question 74easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is a key requirement for audit documentation?

Question 75mediummultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

Question 76mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between an internal audit and an external audit?

Question 77hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of data privacy regulations. The auditor finds that the organization's privacy policy is not fully aligned with regulatory requirements. Which of the following is the auditor's BEST course of action?

Question 78easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following evidence types involves the auditor independently performing a control procedure to verify its effectiveness?

Question 79mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of statistical sampling methods? (Select TWO.)

Question 80hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are phases of the audit process as defined by ISACA? (Select THREE.)

Question 81mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the effectiveness of controls over a critical financial application. Which TWO of the following are appropriate audit procedures to test the design and implementation of controls? (Select TWO.)

Question 82mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?

Question 83easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY reason an external audit is considered more independent than an internal audit?

Question 84hardmultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

Question 85mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of the accounts payable process. Which audit procedure is the auditor primarily executing?

Question 86easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which phase of the audit process includes the development of an audit programme?

Question 87mediummultiple choice

Read the full Information System Auditing Process explanation →

An auditor is selecting a sample of purchase orders for testing. The auditor decides to select every 50th purchase order from a list. This is an example of:

Question 88hardmultiple choice

Read the full Information System Auditing Process explanation →

Which of the following best describes audit risk in the context of an IS audit?

Question 89mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

Question 90easymultiple choice

Read the full Information System Auditing Process explanation →

Which type of audit is primarily concerned with evaluating the efficiency and effectiveness of operations?

Question 91mediummultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the auditor identifies a control deficiency that could result in a material misstatement. According to ISACA guidelines, this is classified as:

Question 92hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is preparing working papers. Which of the following items should be included in the permanent file rather than the current file?

Question 93mediummultiple choice

Read the full Information System Auditing Process explanation →

An external auditor is conducting a compliance audit for a company subject to SOX. Which standard is most relevant for this engagement?

Question 94mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of analytical procedures used in an IS audit? (Select two.)

Question 95hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are required components of a SMART recommendation? (Select three.)

Question 96easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are phases of the audit process? (Select two.)

Question 97easymultiple choice

Read the full Information System Auditing Process explanation →

During which phase of the IS audit process does the auditor perform walkthroughs and test controls?

Question 98mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of a new financial application. The auditor determines that inherent risk is high due to complex transactions, but control risk is low because of strong automated controls. If detection risk is set at 5%, what is the audit risk?

Question 99hardmultiple choice

Read the full Information System Auditing Process explanation →

Which of the following best describes the primary advantage of using statistical sampling over non-statistical sampling in an IS audit?

Question 100mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of a company's data privacy practices. Which type of evidence would be most appropriate to verify that employees have completed mandatory privacy training?

Question 101hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the audit documentation from a prior year and finds that a material weakness was reported but not remediated. According to ISACA standards, which audit phase should address this?

Question 102easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of audit evidence recognized in IS audit practice?

Question 103mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are components of audit risk in IS auditing?

Question 1easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is MOST likely to be performed by an organization's own employees?

Question 2easymultiple choice

Read the full Information System Auditing Process explanation →

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Question 3mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a financial system. The auditor identifies that the inherent risk is high due to the complexity of transactions, but control risk is low because of strong automated controls. Which component of audit risk will be MOST affected by the auditor's testing strategy?

Question 4mediummultiple choice

Read the full Information System Auditing Process explanation →

Which type of audit evidence involves the auditor independently performing a control procedure to verify its effectiveness?

Question 5hardmultiple choice

Read the full Information System Auditing Process explanation →

In a risk-based audit approach, which of the following BEST describes how an IS auditor should prioritize audit coverage?

Question 6mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?

Question 7easymultiple choice

Read the full Information System Auditing Process explanation →

Which document is typically included in the permanent file of audit documentation?

Question 8mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit, the auditor uses ratio analysis to compare current year expenses to prior years and industry benchmarks. This is an example of which type of audit evidence?

Question 9hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor identifies a control deficiency that could result in a material misstatement in the financial statements. According to audit reporting standards, this should be classified as:

Question 10mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between internal and external auditors?

Question 11easymultiple choice

Read the full Information System Auditing Process explanation →

What is the primary purpose of the planning phase in an IS audit?

Question 12hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?

Question 13mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a characteristic of non-statistical (judgmental) sampling?

Question 14mediummultiple choice

Read the full Information System Auditing Process explanation →

During the follow-up phase of an audit, the auditor discovers that a previous finding has not been remediated. What is the auditor's BEST course of action?

Question 15hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing audit risk for a payroll system. The inherent risk is assessed as moderate, control risk as high due to weak segregation of duties, and detection risk is set at low because of extensive substantive testing. What is the impact on overall audit risk?

Question 16mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Question 17hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Question 18mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Question 19easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

Question 20mediummultiple choice

Read the full Information System Auditing Process explanation →

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Question 21hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?

Question 22mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

Question 23easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is selecting audit procedures to test controls over user access. Which of the following is an example of a re-performance procedure?

Question 24mediummultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

Question 25hardmultiple choice

Read the full Information System Auditing Process explanation →

During the fieldwork phase, an IS auditor discovers that a control is not operating as designed. The auditor reperforms the control and finds that it is effective. Which of the following conclusions is MOST appropriate?

Question 26mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between internal and external IS auditors?

Question 27easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Question 28hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

Question 29mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

Question 30easymultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the IS auditor identifies that the audit team lacks the technical expertise to evaluate a specific system. According to ISACA standards, the auditor should:

Question 31mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?

Question 32hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?

Question 33mediummultiple choice

Read the full Information System Auditing Process explanation →

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Question 34mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the effectiveness of controls over a critical financial system. Which TWO types of evidence provide the highest level of assurance? (Select TWO.)

Question 35hardmulti select

Read the full Information System Auditing Process explanation →

An IS auditor is performing a risk assessment for an audit of a cloud service provider. Which THREE factors should be considered when assessing inherent risk? (Select THREE.)

Question 36easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are components of audit risk in the ISACA risk model? (Select TWO.)

Question 37easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is most likely to be conducted by an employee of the organization being audited, potentially raising independence concerns?

Question 38mediummultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. Which of the following actions should the auditor prioritize?

Question 39hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing the effectiveness of a control that requires dual authorization for all transactions over $10,000. The population consists of 5,000 transactions, of which 250 exceed the threshold. The auditor uses a sample of 50 transactions from the entire population and finds 3 exceptions. What type of sampling method did the auditor use?

Question 40mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the best example of audit evidence obtained through re-performance?

Question 41easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Question 42mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

Question 43hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

Question 44mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a permanent file item in an IS audit working paper?

Question 45easymultiple choice

Read the full Information System Auditing Process explanation →

A compliance audit is primarily concerned with:

Question 46mediummultiple choice

Read the full Information System Auditing Process explanation →

During a risk-based audit, the IS auditor identifies a control deficiency that could lead to a material misstatement in financial reporting. According to standard classification, this is best described as a:

Question 47hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of a purchase-to-pay process. The auditor selects a sample of purchase orders and traces them through the system to verify that controls are properly designed and implemented. This is an example of:

Question 48mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the most reliable form of audit evidence?

Question 49mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Question 50hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)

Question 51easymulti select

Read the full Information System Auditing Process explanation →

According to ISACA audit standards, which TWO of the following are phases of the audit process? (Select two.)

Question 52easymultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, which of the following is the PRIMARY purpose of conducting a risk assessment?

Question 53mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of a purchase-to-pay process. Which of the following is the auditor most likely trying to achieve?

Question 54mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following types of audit evidence provides the highest level of assurance?

Question 55hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor uses statistical sampling to test a population of 10,000 transactions. The auditor discovers 5 errors in the sample of 200. Which of the following conclusions is most appropriate?

Question 56easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY reason for an external IS audit to be more independent than an internal audit?

Question 57mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit of an IT department, the auditor finds that system uptime is 99.9% but the department missed two critical project deadlines. Which conclusion is most appropriate?

Question 58mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of audit working papers?

Question 59hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?

Question 60easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is an example of a compliance audit?

Question 61mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Question 62hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor finds that a control deficiency could lead to a material misstatement if combined with another deficiency. How should this be classified?

Question 63mediummultiple choice

Read the full Information System Auditing Process explanation →

During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?

Question 64mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Question 65hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE factors should an IS auditor consider when determining the sample size for a compliance test? (Select three.)

Question 66mediummulti select

Read the full Information System Auditing Process explanation →

In the audit follow-up phase, which TWO actions are essential? (Select two.)

Question 67easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Question 68mediummultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. The audit team has limited experience with this ERP. Which of the following is the BEST course of action?

Question 69hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?

Question 70easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of audit working papers?

Question 71mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

Question 72mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the BEST example of an analytical procedure used during an IS audit?

Question 73hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a decentralized organization with multiple business units. The auditor wants to use a risk-based approach. Which of the following is the MOST appropriate factor to prioritize audit coverage?

Question 74easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is a key requirement for audit documentation?

Question 75mediummultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

Question 76mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between an internal audit and an external audit?

Question 77hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of data privacy regulations. The auditor finds that the organization's privacy policy is not fully aligned with regulatory requirements. Which of the following is the auditor's BEST course of action?

Question 78easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following evidence types involves the auditor independently performing a control procedure to verify its effectiveness?

Question 79mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of statistical sampling methods? (Select TWO.)

Question 80hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are phases of the audit process as defined by ISACA? (Select THREE.)

Question 81mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the effectiveness of controls over a critical financial application. Which TWO of the following are appropriate audit procedures to test the design and implementation of controls? (Select TWO.)

Question 82mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?

Question 83easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY reason an external audit is considered more independent than an internal audit?

Question 84hardmultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

Question 85mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of the accounts payable process. Which audit procedure is the auditor primarily executing?

Question 86easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which phase of the audit process includes the development of an audit programme?

Question 87mediummultiple choice

Read the full Information System Auditing Process explanation →

An auditor is selecting a sample of purchase orders for testing. The auditor decides to select every 50th purchase order from a list. This is an example of:

Question 88hardmultiple choice

Read the full Information System Auditing Process explanation →

Which of the following best describes audit risk in the context of an IS audit?

Question 89mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

Question 90easymultiple choice

Read the full Information System Auditing Process explanation →

Which type of audit is primarily concerned with evaluating the efficiency and effectiveness of operations?

Question 91mediummultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the auditor identifies a control deficiency that could result in a material misstatement. According to ISACA guidelines, this is classified as:

Question 92hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is preparing working papers. Which of the following items should be included in the permanent file rather than the current file?

Question 93mediummultiple choice

Read the full Information System Auditing Process explanation →

An external auditor is conducting a compliance audit for a company subject to SOX. Which standard is most relevant for this engagement?

Question 94mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of analytical procedures used in an IS audit? (Select two.)

Question 95hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are required components of a SMART recommendation? (Select three.)

Question 96easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are phases of the audit process? (Select two.)

Question 97easymultiple choice

Read the full Information System Auditing Process explanation →

During which phase of the IS audit process does the auditor perform walkthroughs and test controls?

Question 98mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of a new financial application. The auditor determines that inherent risk is high due to complex transactions, but control risk is low because of strong automated controls. If detection risk is set at 5%, what is the audit risk?

Question 99hardmultiple choice

Read the full Information System Auditing Process explanation →

Which of the following best describes the primary advantage of using statistical sampling over non-statistical sampling in an IS audit?

Question 100mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of a company's data privacy practices. Which type of evidence would be most appropriate to verify that employees have completed mandatory privacy training?

Question 101hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the audit documentation from a prior year and finds that a material weakness was reported but not remediated. According to ISACA standards, which audit phase should address this?

Question 102easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of audit evidence recognized in IS audit practice?

Question 103mediummulti select

Read the full Information System Auditing Process explanation →