CISA Information System Auditing Process Practice Question
An IS auditor is conducting a preliminary review of a newly acquired subsidiary and needs to understand the organizational structure, key business processes, and the technology environment before drafting the engagement plan. Which of the following techniques is MOST appropriate for gathering this broad understanding?
⚠ Common exam trap
The trap here is assuming that reviewing prior audit working papers is always the most efficient planning technique, when for a new subsidiary no relevant history exists and interviews are the practical way to build initial understanding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conducting interviews with key personnel
During preliminary review the auditor's objective is broad understanding, not verification. Interviewing management and process owners quickly reveals structure, processes, and technology, and lets the auditor follow up with documentation review or observation where answers are unclear. Detailed techniques such as walk-throughs, control testing, or reliance on prior papers presuppose knowledge the auditor does not yet possess for a newly acquired subsidiary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Testing the operating effectiveness of general IT controls
Why it's wrong here
Testing operating effectiveness is a substantive audit procedure performed after the auditor understands the environment and has identified the controls on which to rely. Performing it during preliminary review would be premature and inefficient, since the engagement scope and key control objectives have not yet been established.
- ✓
Conducting interviews with key personnel
Why this is correct
Interviews with management and process owners efficiently capture organizational structure, business objectives, key processes, and the technology environment. ISACA guidance identifies interviews and discussions with auditees as a primary information-gathering technique during the preliminary phase, allowing the auditor to scope the engagement before committing to detailed testing.
- ✗
Reviewing prior audit working papers
Why it's wrong here
Prior working papers are valuable for continuity, but for a newly acquired subsidiary there is typically no relevant audit history. Even where past papers exist, they reflect an earlier period and cannot reliably describe the current organizational structure and technology environment, so they are insufficient as the primary technique.
- ✗
Performing a walk-through of selected transactions
Why it's wrong here
A walk-through traces individual transactions through the processing cycle to confirm how a specific control operates. It is a detailed test of control design and implementation, not a broad technique for gaining an enterprise-level understanding of structure, processes, and technology during preliminary planning of a new subsidiary.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.