CISA Information System Auditing Process Practice Test 6 — 15 Questions

Question 1

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Accepted Answer

External audit. External audits are conducted by third-party auditors to provide independent assurance, often required by regulations or standards.

Answer

Operational audit

Answer

IS audit

Answer

Internal audit

Question 2

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. The audit team has limited experience with this ERP. Which of the following is the BEST course of action?

Accepted Answer

Engage an external specialist with ERP expertise to supplement the audit team.. When the audit team lacks the technical competence to audit a newly implemented system, ISACA standards require the auditor to obtain the necessary expertise rather than dilute the audit. Engaging an external specialist with ERP expertise supplements the team, preserves audit independence and objectivity, and allows the audit to proceed on schedule with appropriate depth. This is explicitly endorsed in the CISA Review Manual under 'audit staffing and competence.'

Answer

Limit the audit scope to exclude the new ERP system.

Answer

Proceed with the audit using existing staff and hope for the best.

Answer

Postpone the audit until the team gains sufficient experience.

Question 3

An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?

Accepted Answer

Test the compensating controls to determine if they adequately mitigate the risk.. When a control gap is identified but management asserts compensating controls exist, the auditor cannot simply accept the assertion — the auditor must obtain evidence that the compensating controls actually operate effectively and reduce the risk to an acceptable level. Testing the compensating controls is the only way to determine whether the residual risk is adequately mitigated before concluding on the control environment.

Answer

Increase the sample size for substantive testing to compensate.

Answer

Immediately report the missing control as a material weakness.

Answer

Ignore the missing control since compensating controls exist.

Question 4

Which of the following is the BEST example of an analytical procedure used during an IS audit?

Accepted Answer

Comparing current period IT expenses to prior periods and investigating significant variances.. Analytical procedures involve evaluating financial information by studying plausible relationships among data. Comparing current period expenses to prior periods is a typical example.

Answer

Observing the data center's physical security controls.

Answer

Reviewing a sample of change requests for proper authorization.

Answer

Interviewing the IT manager about change management procedures.

Question 5

An IS auditor is planning an audit of a decentralized organization with multiple business units. The auditor wants to use a risk-based approach. Which of the following is the MOST appropriate factor to prioritize audit coverage?

Accepted Answer

The results of a risk assessment evaluating inherent risk and control effectiveness.. A risk-based audit approach prioritizes coverage based on the likelihood and impact of risk, which is precisely what a risk assessment evaluating inherent risk and control effectiveness produces. Inherent risk reflects the susceptibility of a process or unit to error or fraud before controls, while control effectiveness indicates how much of that risk is mitigated. Combining these two factors lets the auditor direct limited audit resources to the areas of greatest residual risk, which is the defining principle of risk-based auditing.

Answer

The geographical location of each business unit.

Answer

The budget allocated to each business unit for IT.

Answer

The number of employees in each business unit.

Question 6

According to ISACA IT Audit Standards, which of the following is a key requirement for audit documentation?

Accepted Answer

Documentation must support the audit findings and conclusions.. According to ISACA IT Audit Standards, audit documentation must support the audit findings and conclusions. This is a fundamental requirement to ensure that the work performed is verifiable and that conclusions are based on sufficient evidence. It allows for review and re-performance.

Answer

Documentation must be retained for at least 10 years.

Answer

Documentation must be reviewed by the audit committee.

Answer

Documentation must be prepared in the local language of the auditee.

Question 7

Which of the following is a key difference between an internal audit and an external audit?

Accepted Answer

Internal auditors are employees of the organization, which may affect independence.. The key difference is that internal auditors are employees of the organization, which creates a potential impairment to independence and objectivity. External auditors are independent third parties engaged to provide an objective opinion on financial statements or specific subject matter.

Answer

External audits are always required by law, while internal audits are voluntary.

Answer

External auditors issue a report to management, while internal auditors report to the board.

Answer

Internal audits focus only on financial controls.

Question 8

An IS auditor is performing a compliance audit of data privacy regulations. The auditor finds that the organization's privacy policy is not fully aligned with regulatory requirements. Which of the following is the auditor's BEST course of action?

Accepted Answer

Report the finding as a non-compliance issue and recommend updates to the policy.. The auditor should report the non-compliance finding and recommend corrective actions, as the primary goal of a compliance audit is to identify gaps.

Answer

Ignore the issue because the policy is only a minor deviation.

Answer

Draft a new privacy policy for the organization.

Answer

Conclude that the organization is compliant because the policy exists.

Question 9

Which of the following evidence types involves the auditor independently performing a control procedure to verify its effectiveness?

Accepted Answer

Re-performance. Re-performance involves the auditor independently executing a control procedure or recalculation to verify its effectiveness. This provides direct evidence of the control's operation. Inspection, observation, and inquiry are less direct forms of evidence.

Answer

Inspection

Answer

Observation

Answer

Inquiry

Question 10

Which TWO of the following are types of statistical sampling methods? (Select TWO.)

Accepted Answer

Stratified sampling. Stratified sampling (B) is a statistical sampling method in which the population is divided into homogeneous subgroups (strata) and random samples are drawn from each stratum, ensuring representation across defined characteristics. Systematic sampling (C) is also statistical: it selects every nth item from a population after a random starting point, applying a measurable, probability-based selection interval. Both are probability-based techniques because each item has a known, non-zero chance of selection, which supports statistical inference. By contrast, block sampling (A) is a non-statistical approach that selects contiguous groups or clusters of items, haphazard sampling (D) relies on convenience with no defined selection probability, and judgmental sampling (E) depends on the auditor's subjective judgment, so none of these are statistical sampling methods.

Answer

Block sampling

Answer

Haphazard sampling

Answer

Judgmental sampling

Question 11

Which THREE of the following are phases of the audit process as defined by ISACA? (Select THREE.)

Accepted Answer

Fieldwork. ISACA's audit process is commonly structured around three core phases: Planning (option D), Fieldwork (option A), and Reporting (option C). Planning (D) is correct because it is the initial phase where the audit scope, objectives, risk assessment, criteria, and resource requirements are defined before any testing begins. Fieldwork (A) is correct because it is the phase in which auditors gather evidence, perform tests of controls and substantive procedures, and document findings to support conclusions. Reporting (C) is correct because it is the phase where the auditor communicates results, including findings, conclusions, and recommendations, to management and the audit committee. Remediation (B) is not a phase of the audit process itself but rather a post-audit management activity of correcting identified issues, and Execution (E) is not an ISACA-defined phase name — it is essentially synonymous with fieldwork and is not used as a distinct phase in ISACA's model.

Answer

Remediation

Answer

Execution

Question 12

An IS auditor is evaluating the effectiveness of controls over a critical financial application. Which TWO of the following are appropriate audit procedures to test the design and implementation of controls? (Select TWO.)

Accepted Answer

Performing a walkthrough of the control process.. Option A (Performing a walkthrough of the control process) is correct because a walkthrough traces a transaction or process from start to finish, allowing the auditor to confirm that the control has been designed as described and is actually implemented in practice. Option E (Inspecting the control documentation and procedure manuals) is correct because examining documented policies, procedures, and control descriptions provides direct evidence of the control's design and whether it has been formally established and communicated. Together, walkthroughs and documentation inspection are standard procedures for testing design and implementation of controls. Option B (penetration test) is a technical security assessment that tests exploitability of vulnerabilities, not the design and implementation of financial application controls. Option C (confirmation letter to the vendor) is a substantive test of balances or transactions, not a control design/implementation test. Option D (ROI calculation) is a business case or performance metric, not an audit procedure for evaluating control design and implementation.

Answer

Performing a penetration test on the application.

Answer

Sending a confirmation letter to the vendor.

Answer

Calculating the return on investment for the application.

Question 13

An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?

Accepted Answer

Risk-based audit approach. A risk-based audit approach prioritizes high-risk areas for more intensive testing, aligning with ISACA standards.

Answer

Substantive approach

Answer

Control self-assessment approach

Answer

Compliance-based approach

Question 14

Which of the following is the PRIMARY reason an external audit is considered more independent than an internal audit?

Accepted Answer

External auditors are not employees of the organization.. The primary reason external auditors are considered more independent is that they are not employees of the organization, so they have no reporting line, compensation, or career dependency on the entity being audited. This structural separation reduces the risk of bias and conflicts of interest. Internal auditors, while ideally independent in function, remain employees and therefore have an inherent organizational relationship that can impair perceived independence.

Answer

External auditors follow stricter standards.

Answer

External auditors have more technical expertise.

Answer

External auditors have access to more resources.

Question 15

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

Accepted Answer

Stratified sampling. Stratified sampling divides the population into homogeneous subgroups (strata) — such as by department, transaction type, or risk level — and then draws samples from each stratum, often proportionally or with higher sampling in high-risk strata. This guarantees representation of every subgroup and reduces sampling risk compared to simple random sampling. It is the standard ISACA-recommended technique when the population is heterogeneous and the auditor needs coverage across distinct categories.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Random sampling