mediumMultiple ChoiceObjective-mapped
CISA Practice Question: An IS auditor is reviewing the audit follow-up…
An IS auditor is reviewing the audit follow-up process. The auditor notes that management has implemented corrective actions for 80% of previous audit findings. What should the auditor conclude?
⚠ Common exam trap
Test-takers frequently assume a high percentage (80%) implies overall effectiveness, but CISA requires verification that all findings, especially high-risk ones, are resolved or formally accepted, not just a majority.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Further investigation of outstanding findings is needed
An 80% closure rate indicates that 20% of findings remain unresolved. ISACA standards require auditors to verify that all high-risk findings are remediated before concluding on control effectiveness. Without evidence that the outstanding 20% are low-risk or have an accepted risk, the auditor must investigate further to ensure residual risk is within the organization's appetite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The audit scope was too narrow
Why it's wrong here
Scope narrowness is not indicated by the implementation rate.
- ✓
Further investigation of outstanding findings is needed
Why this is correct
Unresolved findings must be assessed for risks and followed up.
- ✗
The audit process is effective
Why it's wrong here
Effectiveness is not determined by implementation rate alone; outstanding findings need review.
- ✗
Management is compliant with all recommendations
Why it's wrong here
20% non-implementation indicates non-compliance for those items.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.