CISA Information System Auditing Process Practice Test 2 — 15 Questions

Question 1

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The control is effective as the sample deviation rate is below the tolerable rate.. The sample deviation rate of 4% (2 out of 50) is below the tolerable deviation rate of 5%. Therefore, the control is considered effective based on the sample evidence. The auditor does not need to increase the sample size unless the deviation rate is close to the tolerable rate or other risk factors exist. In this case, the control can be relied upon as designed.

Answer

The auditor should increase the sample size to reduce sampling risk.

Answer

The control is ineffective because deviations were found.

Answer

The auditor should conclude that the control is ineffective and report a deficiency.

Question 2

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

Accepted Answer

Material weakness. A deficiency that could lead to unauthorized modification of financial data, with no compensating control, represents a material weakness because it could result in material misstatement of financial statements. Material weakness is the most severe classification, indicating a significant deficiency or combination of deficiencies that results in a reasonable possibility of material misstatement. The auditor should classify it as such.

Answer

Deficiency

Answer

Observation

Answer

Finding

Question 3

Which of the following best describes audit risk in the context of an IS audit?

Accepted Answer

Risk that the auditor will issue an incorrect opinion.. Audit risk is defined as the risk that the auditor will issue an incorrect opinion (option C). Option B represents the audit risk model (Inherent risk × Control risk × Detection risk), which is a formula for assessing audit risk, not the definition itself. Therefore, C is the best description.

Answer

Risk that a material misstatement exists.

Answer

Inherent risk × Control risk × Detection risk

Answer

Risk that controls will not prevent or detect errors.

Question 4

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

Accepted Answer

Re-performance. Re-performance involves the auditor independently executing the control to verify its effectiveness.

Answer

Inquiry

Answer

Observation

Answer

Inspection

Question 5

During an audit, the auditor identifies a control deficiency that could result in a material misstatement. According to ISACA guidelines, this is classified as:

Accepted Answer

Material weakness. A material weakness is a deficiency that could result in a material misstatement.

Answer

Finding

Answer

Deficiency

Answer

Observation

Question 6

An external auditor is conducting a compliance audit for a company subject to SOX. Which standard is most relevant for this engagement?

Accepted Answer

GAAS. GAAS (Generally Accepted Auditing Standards) is the correct answer because SOX compliance audits are financial statement audits performed by external auditors, and GAAS provides the authoritative standards for planning, conducting, and reporting on such audits. GAAS, established by the AICPA, ensures auditors obtain reasonable assurance that financial statements are free from material misstatement, which is central to SOX Section 404 requirements for internal control over financial reporting. Other standards like IIA or ISACA are more focused on internal audit or IT audit, not the external financial audit mandated by SOX.

Answer

IIA Standards

Answer

ISACA IT Audit Standards

Answer

COBIT

Question 7

Which THREE of the following are required components of a SMART recommendation? (Select three.)

Accepted Answer

Specific. A SMART recommendation must be Specific (C), meaning it states exactly what action to take, on which resource, and for whom, leaving no ambiguity about scope. It must be Measurable (E), so the recommendation defines a concrete metric or KPI (for example, reducing monthly spend by $500 or lowering CPU utilization below 60%) that lets you verify whether the goal was achieved. It must also be Time-bound (D), attaching a deadline or target date so the recommendation has a defined completion window rather than being open-ended. The remaining options do not belong: Auditable (A) and Cost-effective (B) are desirable qualities of a recommendation but are not letters of the SMART acronym, which stands for Specific, Measurable, Achievable, Relevant, and Time-bound.

Answer

Auditable

Answer

Cost-effective

Question 8

An IS auditor is assessing the risk of a new financial application. The auditor determines that inherent risk is high due to complex transactions, but control risk is low because of strong automated controls. If detection risk is set at 5%, what is the audit risk?

Accepted Answer

0.8%. Audit risk = Inherent risk × Control risk × Detection risk. Assuming inherent risk = 80%, control risk = 20%, detection risk = 5%, audit risk = 0.8 × 0.2 × 0.05 = 0.008 = 0.8%.

Answer

8.0%

Answer

1.0%

Answer

5.0%

Question 9

Which of the following audit types is MOST likely to be performed by an organization's own employees?

Accepted Answer

Internal audit. An internal audit is performed by an organization's own employees, typically as part of an internal audit department, to evaluate the effectiveness of internal controls, risk management, and governance processes. This is distinct from external audits, which are conducted by independent third parties.

Answer

External audit

Answer

IS audit

Answer

Compliance audit

Question 10

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Accepted Answer

Fieldwork. Fieldwork is the phase where the auditor executes the planned audit procedures, including inquiry, observation, inspection, reperformance, and data analysis, to gather evidence and evaluate controls. Planning is about understanding the process and designing procedures; reporting is about communicating results; follow-up addresses remediation. Therefore, the procedures listed are performed during fieldwork.

Answer

Follow-up

Answer

Reporting

Answer

Planning

Question 11

An IS auditor is planning an audit of a financial system. The auditor identifies that the inherent risk is high due to the complexity of transactions, but control risk is low because of strong automated controls. Which component of audit risk will be MOST affected by the auditor's testing strategy?

Accepted Answer

Detection risk. Detection risk is the risk that the auditor's procedures will not detect a material misstatement. It is directly influenced by the auditor's testing strategy: the nature, timing, and extent of audit procedures. When inherent risk is high and control risk is low, the auditor can accept a higher detection risk, but the testing strategy (e.g., more substantive testing) affects detection risk. Inherent and control risks are assessed, not affected by testing.

Answer

Inherent risk

Answer

Control risk

Answer

Audit risk

Question 12

Which type of audit evidence involves the auditor independently performing a control procedure to verify its effectiveness?

Accepted Answer

Re-performance. Re-performance is when the auditor independently executes a control to confirm it operates as intended.

Answer

Inspection

Answer

Observation

Answer

Inquiry

Question 13

In a risk-based audit approach, which of the following BEST describes how an IS auditor should prioritize audit coverage?

Accepted Answer

Allocate more audit resources to areas with higher risk and lower control effectiveness. A risk-based approach focuses on areas with higher inherent risk and weaker controls to maximize effectiveness.

Answer

Focus on areas where management has requested review

Answer

Concentrate solely on areas with the highest inherent risk

Answer

Focus equally on all areas of the audited entity

Question 14

An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?

Accepted Answer

Random sampling. Using a random number generator to select 50 transactions from a population of 1,000 is the definition of random sampling, where every item in the population has an equal chance of being selected. This method is a form of statistical sampling that supports projection of results to the population.

Answer

Stratified sampling

Answer

Systematic sampling

Answer

Judgmental sampling

Question 15

Which document is typically included in the permanent file of audit documentation?

Accepted Answer

Organizational chart. The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts.

Answer

Management representation letter

Answer

Current year audit program

Answer

Working papers for testing