CISA Information System Auditing Process Practice Question
Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Testing controls
Option B (Testing controls) is correct because the fieldwork phase is where the auditor executes the audit program by gathering evidence and evaluating whether controls are designed and operating effectively, which is the core of substantive and compliance testing. Option E (Performing walkthroughs) is correct because walkthroughs are an evidence-gathering technique performed during fieldwork to trace transactions or processes through the system and confirm the auditor's understanding of controls in operation. Option A (Defining audit scope) is incorrect because scope definition occurs during the planning phase, before fieldwork begins. Option C (Developing the audit program) is incorrect because the audit program is designed in the planning phase to guide the subsequent fieldwork. Option D (Issuing the draft report) is incorrect because reporting occurs after fieldwork is completed, during the reporting phase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defining audit scope
Why it's wrong here
Scope definition occurs during audit planning, before fieldwork begins, so it cannot be a fieldwork activity. It is tempting because scoping shapes which controls get tested, but the fieldwork phase covers evidence gathering and testing against the already-approved scope. Planning precedes fieldwork; reporting follows it.
- ✓
Testing controls
Why this is correct
Testing controls occurs during fieldwork, where the auditor executes procedures such as inspection, inquiry, observation and re-performance to gather evidence supporting the preliminary control effectiveness conclusions formed during planning, directly satisfying the stem's fieldwork requirement.
- ✗
Developing the audit program
Why it's wrong here
The audit programme is drafted during planning, not fieldwork; it lists the procedures to be executed. Fieldwork then executes those procedures and gathers evidence. The confusion is understandable because the programme guides fieldwork, but its development is a planning deliverable, completed before testing starts.
- ✗
Issuing the draft report
Why it's wrong here
Draft report issuance belongs to the reporting phase, which follows fieldwork once evidence is evaluated. It is tempting because findings surface during fieldwork, yet the draft report is a post-fieldwork deliverable. Fieldwork itself comprises evidence collection, control testing and documentation of results.
- ✓
Performing walkthroughs
Why this is correct
Performing walkthroughs sits within fieldwork, tracing transactions through the process to verify that controls described during planning actually operate as documented, thereby producing evidence that supports or refutes the auditor's initial understanding before substantive testing concludes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.