CISA Information System Auditing Process Practice Test 4 — 15 Questions

Question 1

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Accepted Answer

Findings, recommendations, and management action plans. According to ISACA's IT Audit Framework and the ISACA Code of Professional Ethics, the final audit report must include the audit findings, recommendations, and management's action plans. Findings describe the condition, criteria, cause, and effect; recommendations provide guidance for remediation; and management action plans document the agreed-upon corrective steps and timelines. This triad ensures the report is complete, actionable, and supports follow-up.

Answer

Only the audit findings

Answer

Only the recommendations

Answer

The audit program and procedures

Question 2

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

Accepted Answer

Review system documentation and conduct walkthroughs. Reviewing system documentation and conducting walkthroughs allows the auditor to understand the intended design and compare it to actual implementation.

Answer

Use analytical procedures to identify anomalies

Answer

Perform detailed testing of transactions

Answer

Interview management and review policies

Question 3

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

Accepted Answer

The specific requirements of the regulation. In a compliance audit, the audit criteria are the standards, laws, regulations, or contractual requirements against which the auditor measures the organization's controls and practices. When auditing against a data privacy regulation, the specific requirements of that regulation are the authoritative source of criteria — they define what compliance actually means. Internal policies and best practices may be relevant context, but they cannot override or substitute for the regulatory requirements themselves.

Answer

Prior audit findings

Answer

Industry best practices

Answer

The organization's internal policies

Question 4

During an audit, the IS auditor identifies that the audit team lacks the technical expertise to evaluate a specific system. According to ISACA standards, the auditor should:

Accepted Answer

Engage a subject matter expert with the required skills. ISACA standards require that auditors possess or obtain the necessary skills and competence to perform the audit. When the audit team lacks technical expertise in a specific area, the standard-compliant response is to engage a subject matter expert (SME) who has the required knowledge, while the auditor retains responsibility for the audit conclusion. This preserves both the quality of the audit evidence and the auditor's professional accountability.

Answer

Skip the evaluation of that system

Answer

Request management to provide training

Answer

Proceed with the audit and document the limitation

Question 5

An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?

Accepted Answer

Comparing current-year expenses to prior-year expenses. Analytical procedures involve evaluating financial information by analyzing plausible relationships among data — comparing current-year expenses to prior-year expenses is a textbook example of such a comparison. It helps the auditor identify unusual fluctuations or trends that warrant further investigation during planning. This is distinct from tests of details and substantive procedures that involve direct evidence gathering.

Answer

Observing the inventory count

Answer

Inspecting authorization forms for signatures

Answer

Confirming account balances with third parties

Question 6

An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?

Accepted Answer

Greater reliance on detective and compensating controls. In a small organization with limited IT staff, the auditor should expect a greater reliance on detective and compensating controls because preventive controls such as segregation of duties and automated enforcement are often impractical. The audit approach must recognize this reality and focus on whether detective controls adequately mitigate the increased risk.

Answer

Reduced audit scope because of limited staff

Answer

Increased reliance on preventive controls due to limited staff

Answer

Use of extensive substantive testing to compensate for weak controls

Question 7

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Accepted Answer

To verify that corrective actions have been implemented effectively. Follow-up ensures that management has taken corrective actions to address the findings and that the risks have been mitigated.

Answer

To update the permanent audit file

Answer

To close the audit engagement

Answer

To identify new risks for the next audit

Question 8

An IS auditor is performing a risk assessment for an audit of a cloud service provider. Which THREE factors should be considered when assessing inherent risk? (Select THREE.)

Accepted Answer

Complexity of the cloud architecture. Inherent risk is assessed before considering controls, so the auditor should focus on factors that increase risk exposure independent of mitigation. Option A (Complexity of the cloud architecture) is correct because multi-tenant, virtualized, and distributed architectures increase the likelihood of misconfigurations, service dependencies, and attack surface, raising inherent risk. Option D (Sensitivity of data stored in the cloud) is correct because the classification and regulatory obligations of the data (e.g., PII, PCI DSS, PHI) directly determine the impact if confidentiality, integrity, or availability is compromised. Option E (Recent changes to the cloud environment) is correct because changes such as new deployments, migrations, or configuration updates introduce instability and unverified states that elevate inherent risk. Options B (Effectiveness of monitoring controls) and C (Strength of access controls) are not inherent risk factors; they are control effectiveness considerations evaluated during the control risk assessment, after inherent risk has been determined.

Answer

Effectiveness of monitoring controls

Answer

Strength of access controls

Question 9

Which of the following audit types is most likely to be conducted by an employee of the organization being audited, potentially raising independence concerns?

Accepted Answer

Internal audit. An internal audit is performed by auditors who are employees of the organization being audited. Because they report within the same organizational structure they are reviewing, their objectivity and independence can be impaired by management pressure, familiarity, or career incentives. This inherent independence concern is why ISACA emphasizes that internal auditors must maintain objectivity and why external audits are often used for higher-assurance opinions.

Answer

IS audit

Answer

Compliance audit

Answer

External audit

Question 10

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. Which of the following actions should the auditor prioritize?

Accepted Answer

Include a review of the ERP system in the audit scope due to the high inherent risk. A newly implemented ERP system represents high inherent risk due to its complexity, cost, and impact on financial reporting and operations, so the auditor should include it in the audit scope. Prioritizing the ERP review ensures that risks introduced by the new system — such as data migration errors, access control gaps, and process changes — are assessed early. Excluding or delaying the audit would leave significant risk unaddressed.

Answer

Exclude the ERP system from the audit scope because it is new and not yet stable

Answer

Delay the audit until the ERP system has been fully stabilized for six months

Answer

Focus only on financial reporting controls related to the ERP system

Question 11

Which of the following is the best example of audit evidence obtained through re-performance?

Accepted Answer

Recalculating the total of a control report to verify accuracy. Re-performance involves the auditor independently executing the same procedure or control that was originally performed by the auditee. Recalculating the total of a control report to verify accuracy is a classic example of re-performance, as the auditor independently computes the total to confirm it matches the report.

Answer

Reviewing log files for unauthorized access attempts

Answer

Interviewing the system administrator about backup procedures

Answer

Observing employees as they process transactions

Question 12

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Accepted Answer

To provide a basis for the audit report and support the auditor's conclusions. Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

Answer

To facilitate the planning of the next audit

Answer

To serve as a legal record for potential litigation

Answer

To demonstrate compliance with audit standards

Question 13

Which of the following is a permanent file item in an IS audit working paper?

Accepted Answer

Organizational chart of the IT department. The organizational chart of the IT department is a permanent file item because it documents the entity's structure and is retained across multiple audit engagements. Permanent files contain information of continuing relevance, such as organizational charts, accounting manuals, and long-term contracts. Current year's audit program and findings are current file items, and confirmation letters are also current file evidence.

Answer

Confirmation letters from vendors

Answer

Current year's audit program

Answer

List of audit findings for the current year

Question 14

A compliance audit is primarily concerned with:

Accepted Answer

Determining whether the organization is following applicable laws and regulations. A compliance audit is primarily concerned with determining whether the organization is adhering to applicable laws, regulations, standards, and contractual obligations. It tests conformity against defined criteria rather than evaluating control effectiveness, operational efficiency, or strategic alignment. The other options describe operational, performance, or strategic audits.

Answer

Evaluating the effectiveness of internal controls

Answer

Assessing the efficiency of IT operations

Answer

Ensuring the organization is meeting its strategic objectives

Question 15

Which of the following is the most reliable form of audit evidence?

Accepted Answer

Re-performance of a control by the auditor. Reperformance by the auditor is the most reliable form of audit evidence because the auditor directly executes the control or procedure and observes the outcome, eliminating reliance on the representations or actions of others. This direct, independent verification provides strong evidence about whether the control operates effectively. Inquiry, observation, and inspection are all less reliable because they are indirect or can be manipulated.

Answer

Inquiry of management about a control

Answer

Observation of a control being performed

Answer

Inspection of signed approval forms