CISA Information System Auditing Process Practice Test 3 — 15 Questions

Question 1

During an operational audit, the auditor uses ratio analysis to compare current year expenses to prior years and industry benchmarks. This is an example of which type of audit evidence?

Accepted Answer

Analytical procedures. Analytical procedures involve evaluating financial information by analyzing plausible relationships among both financial and non-financial data. Ratio analysis comparing current expenses to prior years and industry benchmarks is a classic analytical procedure used to identify unusual fluctuations or trends. This type of evidence is indirect but highly effective for risk assessment and substantive testing. Under ISACA standards, analytical procedures are a key method for obtaining audit evidence.

Answer

Inquiry

Answer

Observation

Answer

Inspection

Question 2

An IS auditor identifies a control deficiency that could result in a material misstatement in the financial statements. According to audit reporting standards, this should be classified as:

Accepted Answer

Material weakness. A control deficiency that could result in a material misstatement in the financial statements should be classified as a material weakness. This is a significant deficiency, or combination of deficiencies, that results in a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

Answer

Finding

Answer

Deficiency

Answer

Observation

Question 3

Which of the following is a key difference between internal and external auditors?

Accepted Answer

External auditors are more independent than internal auditors. External auditors are independent third parties, while internal auditors are employees of the organization.

Answer

Internal auditors are required for regulatory compliance

Answer

Internal auditors focus only on financial controls

Answer

External auditors have deeper organizational knowledge

Question 4

What is the primary purpose of the planning phase in an IS audit?

Accepted Answer

To identify risks and define audit scope. The planning phase of an IS audit is where the auditor defines the audit objectives, identifies and assesses risks, determines the scope and criteria, and develops the audit program. This foundational phase ensures that the audit is focused on the areas of greatest risk and that resources are allocated effectively.

Answer

To execute audit tests

Answer

To issue the final report

Answer

To follow up on findings

Question 5

An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?

Accepted Answer

Observation and re-performance. The auditor observed the control being performed (observation) and then independently performed the same control to confirm the result (re-performance). This combination of observation and re-performance provides strong evidence of control effectiveness because the auditor both witnesses and independently verifies the control. Inquiry and inspection are not the primary techniques used here.

Answer

Inquiry and inspection

Answer

Inspection and observation

Answer

Analytical procedures and inquiry

Question 6

Which of the following is a characteristic of non-statistical (judgmental) sampling?

Accepted Answer

The auditor uses professional judgment to select sample items. Non-statistical (judgmental) sampling is characterized by the auditor's use of professional judgment to select sample items, determine sample size, and evaluate results. Unlike statistical sampling, it does not rely on probability theory or mathematical formulas. The auditor chooses items based on risk, materiality, and experience — for example, selecting all transactions above a threshold or focusing on high-risk areas.

Answer

Every item has an equal chance of selection

Answer

The sample size is determined using statistical formulas

Answer

The sample results can be projected to the population with known confidence

Question 7

During the follow-up phase of an audit, the auditor discovers that a previous finding has not been remediated. What is the auditor's BEST course of action?

Accepted Answer

Report the lack of remediation to senior management. When a previously reported finding remains unremediated after the agreed follow-up period, the auditor's responsibility shifts from re-testing to escalation. ISACA audit standards require that unresolved findings be reported to senior management (and ultimately the board/audit committee) so that those with authority to accept risk or allocate resources are formally made aware. Reporting the lack of remediation preserves the audit trail and forces a documented management decision (remediate, accept, or mitigate).

Answer

Perform additional testing to confirm the finding

Answer

Ignore the finding since it was previously reported

Answer

Close the finding as accepted risk

Question 8

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Accepted Answer

Testing controls. Option B (Testing controls) is correct because the fieldwork phase is where the auditor executes the audit program by gathering evidence and evaluating whether controls are designed and operating effectively, which is the core of substantive and compliance testing. Option E (Performing walkthroughs) is correct because walkthroughs are an evidence-gathering technique performed during fieldwork to trace transactions or processes through the system and confirm the auditor's understanding of controls in operation. Option A (Defining audit scope) is incorrect because scope definition occurs during the planning phase, before fieldwork begins. Option C (Developing the audit program) is incorrect because the audit program is designed in the planning phase to guide the subsequent fieldwork. Option D (Issuing the draft report) is incorrect because reporting occurs after fieldwork is completed, during the reporting phase.

Answer

Defining audit scope

Answer

Developing the audit program

Answer

Issuing the draft report

Question 9

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. A SMART recommendation must be Measurable (A), meaning it includes quantifiable criteria or metrics (e.g., a percentage, count, or threshold) so progress and success can be objectively verified. It must also be Time-bound (C), specifying a deadline or timeframe (e.g., "within 90 days") so the recommendation has a defined completion point. Finally, it must be Specific (D), clearly stating the exact action, system, or process to be changed rather than a vague aspiration. The unmarked options do not belong: General (B) contradicts the specificity requirement of SMART, and Subjective (E) is wrong because SMART criteria rely on objective, verifiable evidence rather than personal opinion.

Answer

General

Answer

Subjective

Question 10

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Accepted Answer

Ratio analysis. Ratio analysis (A) is a classic analytical procedure because it evaluates financial information by comparing relationships among accounts (e.g., current ratio, gross margin percentage) to identify unusual fluctuations or inconsistencies that may indicate misstatement. Trend analysis (D) is likewise analytical, as it compares financial data across periods (e.g., year-over-year revenue growth) to spot significant variances requiring further audit attention. Both fall under the analytical procedures defined in auditing standards (e.g., AU-C 520), which involve evaluations of financial information through analysis of plausible relationships among financial and nonfinancial data. By contrast, inquiry of management (B) is a form of audit evidence obtained through questioning, not analysis; inspection of documents (C) is a substantive test of details involving examination of records; and observation of process (E) is a procedure of watching a process or procedure being performed, none of which constitute analytical procedures.

Answer

Inquiry of management

Answer

Inspection of documents

Answer

Observation of process

Question 11

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

Accepted Answer

It focuses audit efforts on areas with the highest risk.. A risk-based approach allows the auditor to focus on areas with higher risk, thereby optimizing the use of audit resources and ensuring that significant risks are addressed.

Answer

It ensures that all controls are tested equally.

Answer

It reduces the overall cost of the audit.

Answer

It guarantees the detection of material misstatements.

Question 12

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Accepted Answer

A material weakness. A material weakness is a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

An observation

Answer

A deficiency

Answer

A finding

Question 13

An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?

Accepted Answer

Statistical attribute sampling. Statistical attribute sampling is the most appropriate method when the auditor wants to achieve a specified confidence level and tolerable error rate for a control that has a binary outcome (exception or no exception). It allows the auditor to project the exception rate to the population and conclude whether the control is operating effectively within the tolerable deviation rate.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Stratified sampling

Question 14

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

Accepted Answer

To gain an understanding of the process and identify control points. A walkthrough is performed during audit planning to trace a transaction or process from start to finish, allowing the auditor to understand how the process actually operates and to pinpoint where controls exist. This understanding is the foundation for scoping the audit, designing test procedures, and identifying risks. It is not a test of control effectiveness — that comes later during fieldwork.

Answer

To test the operating effectiveness of controls

Answer

To collect evidence of control failures

Answer

To identify process owners and key personnel

Question 15

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

Accepted Answer

The risk assessment of the area under review. The most important consideration when determining the scope of an IS audit is the risk assessment of the area under review. ISACA standards emphasize a risk-based approach, where audit resources are directed to areas with the highest risk. This ensures that the audit addresses the most significant threats to the organization.

Answer

The availability of audit staff

Answer

The budget approved for the audit

Answer

The results of prior audit findings