CISA Information System Auditing Process Practice Question
An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?
⚠ Common exam trap
CISA often tests the audit risk model; candidates may incorrectly exclude detection risk, thinking it is only the auditor's responsibility, but it is an integral part of the model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inherent risk, control risk, and detection risk
The audit risk model comprises inherent risk, control risk, and detection risk. All three are directly relevant when assessing fraud risk because fraud can arise from inherent susceptibility, control failures, or the auditor's failure to detect it. The combination of all three determines the overall audit risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Control risk and detection risk only
Why it's wrong here
Control and detection risk omit inherent risk, the susceptibility of the account balance to fraud before controls are considered. It is tempting because controls and audit procedures are both auditor-facing; this pairing would be correct when evaluating control reliance and testing strategy, not when assessing the underlying fraud risk of the financial system.
- ✗
Inherent risk and detection risk only
Why it's wrong here
Detection risk concerns whether audit procedures miss a material misstatement; it does not describe the entity's susceptibility to fraud. It is tempting because detection risk is central to audit planning; it would be the correct focus when designing substantive testing to reduce the risk of an undetected misstatement, not when assessing fraud risk itself.
- ✓
Inherent risk, control risk, and detection risk
Why this is correct
The audit risk model comprises inherent risk, control risk and detection risk, and fraud assessment turns on the same three components: susceptibility of the account to fraud, effectiveness of controls, and the auditor's procedures. Combining them directly satisfies the stem's request for the most relevant combination.
- ✗
Inherent risk and control risk only
Why it's wrong here
Inherent and control risk together give the risk of material misstatement, but omitting detection risk leaves the auditor's own procedures unconsidered. It is tempting because these two components describe the entity's fraud exposure; they would be the right pairing when scoping the nature and extent of audit work, not the full fraud risk assessment.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.