CISA Information System Auditing Process Practice Question
An IS auditor has completed fieldwork for an audit of a data center's physical access controls and has documented several findings. Before drafting the final report, the auditor discusses the findings with the data center manager. Which of the following is the PRIMARY purpose of this discussion?
⚠ Common exam trap
Many exam-takers confuse the validation discussion with the later agreement on corrective actions, when the immediate purpose is to confirm factual accuracy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To validate the accuracy and completeness of the findings with the auditee
Before issuing the report, the auditor discusses findings with the auditee to confirm that the facts and evidence are accurate and complete. This validation protects against factual errors, allows management to provide clarifying information, and gives the auditee a chance to respond. It is not a negotiation to reduce evidence, exclude valid findings, or obtain remediation commitments, although management responses are captured for the report.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To obtain management's agreement on the corrective actions and target dates
Why it's wrong here
Agreeing on corrective actions is valuable, but it typically occurs after findings are validated and is not the primary purpose of the initial discussion. The immediate goal is to confirm the factual accuracy of the findings and allow management to respond. Commitments on remediation usually follow once management accepts the findings, so treating agreement as the primary purpose puts the cart before the horse and could bias the auditor toward negotiated rather than factual conclusions.
- ✗
To determine whether the findings should be excluded from the final report
Why it's wrong here
Findings are excluded only when they are not supported by evidence or fall outside the audit scope, not because management disagrees with them. Management's objections should be recorded as a response, but valid findings remain in the report. Using the discussion as a mechanism to suppress findings would compromise the auditor's independence and objectivity, so this cannot be the purpose of the conversation.
- ✓
To validate the accuracy and completeness of the findings with the auditee
Why this is correct
Discussing findings with the auditee before finalizing the report confirms that the facts, conditions, and evidence are accurate and complete, and it gives management an opportunity to correct misunderstandings or provide additional context. This validation step strengthens the reliability of the report and reduces the risk of factual errors. It is a fundamental quality control activity in the audit process and the primary reason for the discussion.
- ✗
To reduce the amount of evidence the auditor needs to gather for each finding
Why it's wrong here
The discussion does not reduce the evidence requirement; sufficient appropriate evidence must already support each finding before it is reported. Management's verbal explanation is not a substitute for documented evidence. Allowing the conversation to shrink the evidence base would weaken the audit and could lead to unsupported conclusions. The purpose of the discussion is validation, not substitution of evidence.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.