CISA Information System Auditing Process Practice Question
An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk-based audit approach
A risk-based audit approach prioritizes high-risk areas for more intensive testing, aligning with ISACA standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Substantive approach
Why it's wrong here
A substantive approach determines the nature of testing (detailed transaction verification) rather than how audit resources are allocated across the application. It is tempting because substantive testing is common in financial audits, but selecting it does not by itself focus effort on the highest-risk areas.
- ✗
Control self-assessment approach
Why it's wrong here
Control self-assessment has business process owners evaluate their own controls; it does not direct auditor effort to high-risk areas, which requires a risk-based approach. It is tempting because CSA gathers control evidence efficiently, but the auditor's own scoping decision is what the stem demands.
- ✗
Compliance-based approach
Why it's wrong here
A compliance-based approach tests against regulations or standards, so effort follows prescribed requirements rather than the highest-risk areas. It is tempting in regulated financial audits, but risk-based planning is what concentrates effort where exposure is greatest, not compliance checklists.
- ✓
Risk-based audit approach
Why this is correct
A risk-based approach directs audit resources toward the areas of highest assessed risk, satisfying the stem's constraint that effort be focused where exposure is greatest. It differs from a compliance-based or control-based approach, which tests uniformly rather than prioritising by likelihood and impact of failure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.