hardMultiple Select
CISA Practice Question: Which TWO of the following are indicators that an…
Which TWO of the following are indicators that an IS auditor may need to adjust the audit approach during fieldwork? (Select TWO.)
⚠ Common exam trap
ISACA often tests the distinction between project management issues (like being behind schedule) and substantive audit evidence issues; candidates mistakenly select 'behind schedule' as a reason to adjust the audit approach, but it is a resource or timing problem, not a validity-of-evidence trigger.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inability to obtain sufficient appropriate audit evidence
Option A is correct because when an IS auditor cannot obtain sufficient appropriate audit evidence, the planned procedures are not yielding a reliable basis for conclusions, so the audit approach (for example, additional or alternative substantive testing, or revised reliance on controls) must be adjusted. Option E is correct because higher-than-expected error rates in sample testing indicate that the assessed level of control risk or the tolerable deviation/error rate may be wrong, requiring the auditor to expand testing, increase sample sizes, or reconsider the nature, timing, and extent of procedures. Option B is not correct because completing the initial risk assessment is a normal, planned phase of the audit that informs the approach rather than a fieldwork indicator that it must change. Option C is not correct because being behind schedule is a project-management or resource issue, not audit evidence or risk information that by itself dictates a change in the audit approach. Option D is not correct because a management-requested scope change is a governance/engagement matter to be evaluated and approved, not an indicator arising from fieldwork evidence that the audit approach needs adjustment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Inability to obtain sufficient appropriate audit evidence
Why this is correct
Insufficient appropriate audit evidence prevents the auditor from reaching a conclusion against the audit objectives, so the planned procedures and scope must be revised. This indicator directly triggers a change in audit approach during fieldwork rather than being deferred to reporting.
- ✗
Completion of the initial risk assessment
Why it's wrong here
Completing the initial risk assessment is a planned fieldwork input that shapes the audit programme before testing begins, not a trigger to change approach mid-fieldwork. It is tempting because risk assessment legitimately drives audit planning, and it would be correct when asked what determines the initial scope.
- ✗
Audit team members are behind schedule
Why it's wrong here
Team members falling behind schedule is a resourcing and project management issue, not evidence that the audit approach itself is misdirected. It is tempting because slippage often prompts reassessment, yet the correct triggers are findings such as control failures or new risks that invalidate the planned procedures.
- ✗
Management requests a change in audit scope
Why it's wrong here
A scope change alters what the audit must cover, which is handled by re-planning and revising the engagement terms, not by adjusting fieldwork technique. It is tempting because it does affect the audit, and would be correct when the objective itself shifts rather than evidence-gathering methods.
- ✓
Higher than expected error rates in sample testing
Why this is correct
Error rates exceeding the level anticipated during planning indicate the control environment is weaker or more variable than assessed, so the sampling and testing strategy no longer fits. This evidence justifies revising the audit approach during fieldwork rather than continuing as planned.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.