CISA Information System Auditing Process Practice Test 5 — 15 Questions

Question 1

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Accepted Answer

Complexity of transactions. Inherent risk is the risk that exists before considering internal controls, so the auditor should focus on factors intrinsic to the system and its transactions. Option A, complexity of transactions, is correct because highly complex transactions increase the likelihood of errors, misstatements, or fraud going undetected, raising inherent risk. Option B, volume of transactions, is correct because a high volume of transactions increases the chance of errors and makes manual verification harder, which elevates inherent risk. Option C, auditor's experience with similar systems, is not an inherent risk factor; it affects the auditor's competence and detection risk, not the risk inherent in the system. Option D, results of prior audits, is not an inherent risk factor; it is evidence used to assess control risk and plan the audit, but it does not define inherent risk. Option E, effectiveness of internal controls, is not an inherent risk factor because inherent risk is assessed before considering controls; control effectiveness relates to control risk.

Answer

Auditor's experience with similar systems

Answer

Results of prior audits

Answer

Effectiveness of internal controls

Question 2

Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)

Accepted Answer

Measurable. Option A (Measurable) is correct because SMART recommendations must include quantifiable criteria or metrics so that auditors and management can objectively verify whether the recommendation has been implemented and its effect assessed. Option C (Specific) is correct because a SMART recommendation must clearly state the exact action, system, process, or control to be addressed, leaving no ambiguity about what is required. Option E (Time-bound) is correct because SMART recommendations must specify a deadline or target timeframe by which the action should be completed, enabling follow-up and accountability. Option B (Vague) is incorrect because vagueness directly contradicts the Specific and Measurable criteria of SMART, making recommendations unverifiable. Option D (Rigid) is incorrect because SMART recommendations should be achievable and adaptable to the organization's context, not inflexible; rigidity is not one of the SMART attributes (Specific, Measurable, Achievable, Relevant, Time-bound).

Answer

Vague

Answer

Rigid

Question 3

During the planning phase of an IS audit, which of the following is the PRIMARY purpose of conducting a risk assessment?

Accepted Answer

To identify high-risk areas for audit focus. A risk assessment identifies high-risk areas to prioritize audit efforts and allocate resources effectively.

Answer

To determine the audit budget

Answer

To obtain management approval

Answer

To select the audit team members

Question 4

An IS auditor is performing a walkthrough of a purchase-to-pay process. Which of the following is the auditor most likely trying to achieve?

Accepted Answer

Understand the process and identify controls. A walkthrough is a preliminary audit technique used to trace a transaction through the entire process from initiation to recording. Its primary purpose is to gain an understanding of the process flow, identify key controls, and assess the design of those controls. Unlike testing, walkthroughs do not involve sampling or verification of accuracy; they are about understanding and documenting the system. Therefore, option A is correct.

Answer

Gather evidence for audit findings

Answer

Test the effectiveness of controls

Answer

Verify the accuracy of transaction data

Question 5

Which of the following types of audit evidence provides the highest level of assurance?

Accepted Answer

Re-performance of control procedures. Re-performance provides direct evidence that a control is operating effectively.

Answer

Inquiry of process owners

Answer

Observation of processes

Answer

Inspection of documents

Question 6

An IS auditor uses statistical sampling to test a population of 10,000 transactions. The auditor discovers 5 errors in the sample of 200. Which of the following conclusions is most appropriate?

Accepted Answer

The population error rate is likely between 1% and 4% at a given confidence level. Statistical sampling produces an estimate with a confidence interval, not a point value, so the correct conclusion is that the true population error rate likely falls within a range around the observed 2.5% (5/200). The option stating a range of 1% to 4% at a given confidence level correctly reflects that sampling results are probabilistic. The other options assert exact rates or draw conclusions about materiality that the sample alone cannot support.

Answer

The population error rate is exactly 2.5%

Answer

The population has a material weakness

Answer

The population error rate is 5%

Question 7

Which of the following is the PRIMARY reason for an external IS audit to be more independent than an internal audit?

Accepted Answer

External auditors are not employees of the organization. External auditors are not employees, reducing organizational pressures and biases.

Answer

External auditors follow stricter standards

Answer

External auditors have more industry knowledge

Answer

External auditors have more resources

Question 8

During an operational audit of an IT department, the auditor finds that system uptime is 99.9% but the department missed two critical project deadlines. Which conclusion is most appropriate?

Accepted Answer

The department is efficient but may not be effective. Efficiency is about doing things right (resource utilization, uptime, throughput), while effectiveness is about doing the right things (achieving objectives such as project deadlines). The department kept systems running (efficient) but missed critical deadlines (not effective), so the correct conclusion is that it is efficient but may not be effective. This distinction is central to ISACA's performance management concepts.

Answer

The department has a material weakness in controls

Answer

The department is operating effectively based on uptime

Answer

The department should be outsourced

Question 9

Which of the following is the PRIMARY purpose of audit working papers?

Accepted Answer

To provide a basis for the audit report. Working papers document audit procedures, evidence, and conclusions to support the audit opinion.

Answer

To facilitate peer review of the audit

Answer

To serve as a legal record of the audit

Answer

To store historical data for future audits

Question 10

An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?

Accepted Answer

Inherent risk, control risk, and detection risk. The audit risk model comprises inherent risk, control risk, and detection risk. All three are directly relevant when assessing fraud risk because fraud can arise from inherent susceptibility, control failures, or the auditor's failure to detect it. The combination of all three determines the overall audit risk.

Answer

Control risk and detection risk only

Answer

Inherent risk and detection risk only

Answer

Inherent risk and control risk only

Question 11

Which of the following is an example of a compliance audit?

Accepted Answer

Evaluating whether IT controls meet SOX requirements. A compliance audit specifically evaluates whether an organization adheres to external laws, regulations, or standards. Option A is correct because SOX (Sarbanes-Oxley Act) is a mandatory regulatory requirement, and auditing IT controls for SOX compliance directly assesses conformity with those legal obligations. This is the essence of a compliance audit—verifying adherence to prescribed rules rather than evaluating performance or efficiency.

Answer

Assessing the performance of a new system

Answer

Reviewing the efficiency of a production line

Answer

Analyzing financial statement ratios

Question 12

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Accepted Answer

Use a risk-based approach to focus on high-risk areas. A risk-based approach is most appropriate because it directs limited audit resources toward the areas of highest risk and impact, which is essential when the organization has constrained IT staffing. This aligns with ISACA's risk-based auditing methodology, ensuring audit effort is proportional to risk rather than spread uniformly or reduced arbitrarily.

Answer

Rely solely on inquiry to reduce workload

Answer

Postpone the audit until more staff are available

Answer

Audit all areas equally to ensure full coverage

Question 13

During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?

Accepted Answer

Investigate the reason for the increase. Analytical procedures are used to identify unusual fluctuations that may indicate errors, fraud, or changes in the environment. A significant increase in IT expenses compared to the prior year is an unexpected variance that must be investigated to determine its cause before concluding whether it represents a finding. Only after understanding the reason can the auditor decide whether it is a reportable issue.

Answer

Report the increase as a finding

Answer

Ignore the increase if it is within budget

Answer

Expand the sample size for testing

Question 14

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Accepted Answer

Re-performance of access provisioning using a test account. Re-performance of access provisioning using a test account (A) is correct because the auditor independently executes the provisioning process and directly verifies whether the system enforces the intended access rules, yielding first-hand evidence that is stronger than documentation or interviews. Inspection of access violation audit logs (B) is correct because these logs are system-generated records that reveal actual attempts to exceed authorized access and whether the controls detected and responded to them, providing objective evidence of control operation. Inquiry of the security administrator (C) is not sufficient because it relies on management's assertions rather than independent verification. Inspection of user access review documentation (D) shows that reviews were documented but does not confirm the underlying access rights are actually correct or enforced. Observation of access request processing (E) only reflects the process at the moment observed and may not represent normal or complete control operation.

Answer

Inquiry of the security administrator

Answer

Inspection of user access review documentation

Answer

Observation of access request processing

Question 15

In the audit follow-up phase, which TWO actions are essential? (Select two.)

Accepted Answer

Assess the effectiveness of the corrective actions. Option A is correct because the audit follow-up phase must evaluate whether the corrective actions taken actually resolved the root cause and reduced the risk to an acceptable level, not merely whether they were performed. Option E is correct because a core follow-up step is verifying that management has implemented the agreed-upon corrective actions within the committed timeframe, confirming the remediation is real and operational. Together, verification (E) establishes that the actions exist, while effectiveness assessment (A) establishes that they work, which are the two essential follow-up outcomes. Option B is wrong because expanding the original audit scope is a new engagement decision, not a required follow-up action. Option C is wrong because re-issuing the audit report is not standard follow-up practice; follow-up results are typically reported separately. Option D is wrong because updating next year's audit program is a planning activity, not an essential action of the follow-up phase itself.

Answer

Expand the scope of the original audit

Answer

Re-issue the audit report

Answer

Update the audit program for next year