mediumMultiple SelectObjective-mapped
CISA Practice Question: An IS auditor is reviewing the design phase of a…
An IS auditor is reviewing the design phase of a new procurement system. Which TWO of the following controls are MOST critical to include in the system design to prevent unauthorized purchases?
⚠ Common exam trap
Many exam-takers confuse detective controls (like audit logging) or security controls (like encryption) with preventive controls that directly stop unauthorized actions, failing to recognize that only preventive controls like approval workflows and segregation of duties address the root cause of unauthorized purchases.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mandatory approval workflows for purchase orders above a threshold.
Mandatory approval workflows for purchase orders above a threshold are critical because they enforce a policy-based control that prevents unauthorized high-value purchases by requiring explicit authorization from a designated approver. This control is designed into the system to intercept transactions that exceed a predefined limit, ensuring that no single user can bypass financial authority limits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mandatory approval workflows for purchase orders above a threshold.
Why this is correct
Prevents unauthorized high-value purchases.
- ✗
Automated performance reports on purchase cycle times.
Why it's wrong here
Monitoring, not prevention.
- ✓
Segregation of duties between requisition and approval.
Why this is correct
Prevents conflicts of interest.
- ✗
Real-time audit logging of all purchase transactions.
Why it's wrong here
Detective control, not preventive.
- ✗
Encryption of purchase order data in transit.
Why it's wrong here
Data protection, not authorization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.