CISA Information System Auditing Process Practice Question
An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?
⚠ Common exam trap
CISA often tests the misconception that limited staff justifies reduced audit scope or increased reliance on preventive controls, when the correct approach is to rely more on detective and compensating controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Greater reliance on detective and compensating controls
In a small organization with limited IT staff, the auditor should expect a greater reliance on detective and compensating controls because preventive controls such as segregation of duties and automated enforcement are often impractical. The audit approach must recognize this reality and focus on whether detective controls adequately mitigate the increased risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduced audit scope because of limited staff
Why it's wrong here
Reducing scope because staff are limited lets resourcing dictate assurance, leaving significant risks unaudited; scope must follow risk, not headcount. It tempts because small organizations do have constrained environments, so a narrower scope is defensible when risk assessment genuinely identifies limited relevant systems.
- ✓
Greater reliance on detective and compensating controls
Why this is correct
Limited IT staff means fewer preventive controls such as segregation of duties, so the auditor emphasises detective and compensating controls to obtain assurance. This approach acknowledges the resource constraint while still addressing risk through monitoring and reconciliation.
- ✗
Increased reliance on preventive controls due to limited staff
Why it's wrong here
In a small organisation with limited IT staff, preventive controls require constant manual configuration and monitoring to remain effective, yet the staff shortage undermines their consistent application. This option is tempting because preventive controls are often seen as proactive security measures that reduce incident response workload, and they would be correct in a larger organisation with dedicated personnel to maintain them. However, the scenario demands detective and compensating controls that function with minimal human intervention.
- ✗
Use of extensive substantive testing to compensate for weak controls
Why it's wrong here
Extensive substantive testing substitutes for reliance on controls, which is inefficient and ignores that limited staff often means key-person dependencies requiring control-based assurance. It tempts because substantive testing is valid when controls are absent or unreliable and detection, not prevention, is the goal.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.