CISA Information System Auditing Process Practice Question
In the audit follow-up phase, which TWO actions are essential? (Select two.)
⚠ Common exam trap
CISA often tests the distinction between follow-up (verify implementation and effectiveness) and other audit activities like re-issuing reports or expanding scope; candidates pick plausible-sounding but non-essential actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assess the effectiveness of the corrective actions
Option A is correct because the audit follow-up phase must evaluate whether the corrective actions taken actually resolved the root cause and reduced the risk to an acceptable level, not merely whether they were performed. Option E is correct because a core follow-up step is verifying that management has implemented the agreed-upon corrective actions within the committed timeframe, confirming the remediation is real and operational. Together, verification (E) establishes that the actions exist, while effectiveness assessment (A) establishes that they work, which are the two essential follow-up outcomes. Option B is wrong because expanding the original audit scope is a new engagement decision, not a required follow-up action. Option C is wrong because re-issuing the audit report is not standard follow-up practice; follow-up results are typically reported separately. Option D is wrong because updating next year's audit program is a planning activity, not an essential action of the follow-up phase itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assess the effectiveness of the corrective actions
Why this is correct
Follow-up must determine whether the corrective action actually remedied the reported condition, not merely that something was done. Assessing effectiveness tests the outcome against the original finding, satisfying the follow-up objective of confirming that risk has been genuinely reduced.
- ✗
Expand the scope of the original audit
Why it's wrong here
Follow-up verifies that agreed remediation was implemented and closes findings; expanding scope reopens planning and is not part of follow-up. It is tempting because auditors may spot related weaknesses, but scope changes belong to a new engagement, not the follow-up of existing findings.
- ✗
Re-issue the audit report
Why it's wrong here
Re-issuing the report duplicates work already completed; follow-up instead verifies that management implemented the agreed corrective actions within the committed timeframe. Re-issuance would be warranted only if the original report contained material errors requiring correction, not as a routine follow-up step.
- ✗
Update the audit program for next year
Why it's wrong here
Updating the audit programme is a planning activity for the next engagement, not a follow-up action on the current findings. It is tempting because audit programmes do get revised after lessons learned, but that occurs during annual planning, whereas follow-up verifies that management has implemented agreed remediation.
- ✓
Verify that management has implemented corrective actions
Why this is correct
Follow-up requires evidence that management actually executed the agreed remediation, since a documented plan alone does not reduce risk. Verifying implementation confirms the control now operates, satisfying the follow-up objective of validating that the reported deficiency has been addressed in practise.
Visual reference
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.