CISA Information System Auditing Process Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reduced audit scope because of limited staff

  Why it's wrong here

  Incorrect; scope should be based on risk, not staff size.

• ✓

  Greater reliance on detective and compensating controls

  Why this is correct

  Correct; when segregation is limited, detective controls become more important.

• ✗

  Increased reliance on preventive controls due to limited staff

  Why it's wrong here

  In a small organisation with limited IT staff, preventive controls require constant manual configuration and monitoring to remain effective, yet the staff shortage undermines their consistent application. This option is tempting because preventive controls are often seen as proactive security measures that reduce incident response workload, and they would be correct in a larger organisation with dedicated personnel to maintain them. However, the scenario demands detective and compensating controls that function with minimal human intervention.

• ✗

  Use of extensive substantive testing to compensate for weak controls

  Why it's wrong here

  Incorrect; substantive testing may increase but not necessarily extensive; the approach should focus on detective controls.

Go deeper

Related to this question