CISA Information System Auditing Process Practice Question

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

External audit

External audits are conducted by third-party auditors to provide independent assurance, often required by regulations or standards.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
External audit
Why this is correct
External audits are conducted by auditors independent of the organisation, satisfying the regulatory-compliance constraint in the stem. This independence from management gives the resulting opinion the objectivity that internal or self-assessment reviews cannot provide, which regulators require when mandating assurance over controls and financial reporting.
✗
Operational audit
Why it's wrong here
An operational audit examines internal processes and controls for effectiveness, and is usually conducted by or for management rather than an independent third party for regulatory filing. It is tempting because it does assess controls, and would be correct for improving internal operational efficiency.
✗
IS audit
Why it's wrong here
An IS audit reviews an organisation's information systems controls, but it is not defined by third-party independence or regulatory mandate; internal staff can perform one. It is tempting because IS audits often support compliance, and would be correct when scoping review of IT governance and controls.
✗
Internal audit
Why it's wrong here
Internal audit is performed by employees within the organisation, so it lacks the independence a third-party regulatory audit requires. It is tempting because internal audit does evaluate controls and compliance, and would be correct for ongoing assurance and management reporting.

Go deeper