CISA Information System Auditing Process Practice Test 4 — 15 Questions

Question 1

During a risk-based audit, the IS auditor identifies a control deficiency that could lead to a material misstatement in financial reporting. According to standard classification, this is best described as a:

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

Observation

Answer

Deficiency

Answer

Finding

Question 2

An IS auditor is performing a walkthrough of a purchase-to-pay process. The auditor selects a sample of purchase orders and traces them through the system to verify that controls are properly designed and implemented. This is an example of:

Accepted Answer

Walkthrough. A walkthrough involves tracing a transaction through the entire process to confirm understanding and assess control design. It combines inquiry, observation, and inspection.

Answer

Analytical procedure

Answer

Test of controls

Answer

Substantive testing

Question 3

Which of the following is the most reliable form of audit evidence?

Accepted Answer

Re-performance of a control by the auditor. Re-performance is the most reliable because the auditor independently performs the control, obtaining direct evidence. Observation is less reliable because the auditor may influence behavior.

Answer

Inquiry of management about a control

Answer

Observation of a control being performed

Answer

Inspection of signed approval forms

Question 4

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Accepted Answer

Complexity of transactions. Inherent risk is the susceptibility to misstatement before considering controls. Complexity of transactions and volume of transactions increase inherent risk. Control effectiveness is part of control risk, and auditor experience relates to detection risk.

Answer

Auditor's experience with similar systems

Answer

Results of prior audits

Answer

Effectiveness of internal controls

Question 5

Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)

Accepted Answer

Measurable. SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound. Vague and rigid are not desirable.

Answer

Vague

Answer

Rigid

Question 6

According to ISACA audit standards, which TWO of the following are phases of the audit process? (Select two.)

Accepted Answer

Reporting. The standard audit process phases are planning, fieldwork, reporting, and follow-up. Risk assessment is part of planning, and testing is part of fieldwork.

Answer

Documentation

Answer

Testing

Answer

Risk assessment

Question 7

During the planning phase of an IS audit, which of the following is the PRIMARY purpose of conducting a risk assessment?

Accepted Answer

To identify high-risk areas for audit focus. A risk assessment identifies high-risk areas to prioritize audit efforts and allocate resources effectively.

Answer

To determine the audit budget

Answer

To obtain management approval

Answer

To select the audit team members

Question 8

An IS auditor is performing a walkthrough of a purchase-to-pay process. Which of the following is the auditor most likely trying to achieve?

Accepted Answer

Understand the process and identify controls. A walkthrough helps the auditor understand the process flow and identify controls in place.

Answer

Gather evidence for audit findings

Answer

Test the effectiveness of controls

Answer

Verify the accuracy of transaction data

Question 9

Which of the following types of audit evidence provides the highest level of assurance?

Accepted Answer

Re-performance of control procedures. Re-performance provides direct evidence that a control is operating effectively.

Answer

Inquiry of process owners

Answer

Observation of processes

Answer

Inspection of documents

Question 10

An IS auditor uses statistical sampling to test a population of 10,000 transactions. The auditor discovers 5 errors in the sample of 200. Which of the following conclusions is most appropriate?

Accepted Answer

The population error rate is likely between 1% and 4% at a given confidence level. Based on sample results, the error rate is 2.5%, which can be projected to the population with a confidence level.

Answer

The population error rate is exactly 2.5%

Answer

The population has a material weakness

Answer

The population error rate is 5%

Question 11

Which of the following is the PRIMARY reason for an external IS audit to be more independent than an internal audit?

Accepted Answer

External auditors are not employees of the organization. External auditors are not employees, reducing organizational pressures and biases.

Answer

External auditors follow stricter standards

Answer

External auditors have more industry knowledge

Answer

External auditors have more resources

Question 12

During an operational audit of an IT department, the auditor finds that system uptime is 99.9% but the department missed two critical project deadlines. Which conclusion is most appropriate?

Accepted Answer

The department is efficient but may not be effective. Operational audit assesses effectiveness and efficiency; missed deadlines indicate inefficiency or ineffectiveness.

Answer

The department has a material weakness in controls

Answer

The department is operating effectively based on uptime

Answer

The department should be outsourced

Question 13

Which of the following is the PRIMARY purpose of audit working papers?

Accepted Answer

To provide a basis for the audit report. Working papers document audit procedures, evidence, and conclusions to support the audit opinion.

Answer

To facilitate peer review of the audit

Answer

To serve as a legal record of the audit

Answer

To store historical data for future audits

Question 14

An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?

Accepted Answer

Inherent risk, control risk, and detection risk. Audit risk = inherent risk × control risk × detection risk; all three combine to determine overall risk.

Answer

Control risk and detection risk only

Answer

Inherent risk and detection risk only

Answer

Inherent risk and control risk only

Question 15

Which of the following is an example of a compliance audit?

Accepted Answer

Evaluating whether IT controls meet SOX requirements. Compliance audits verify adherence to laws, regulations, and policies.

Answer

Assessing the performance of a new system

Answer

Reviewing the efficiency of a production line

Answer

Analyzing financial statement ratios