CISA Information Systems Auditing Process practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

CISA Information Systems Auditing Process: 522 practice questions

CISA 522 questions 12 shown free

12 of the 522 Information Systems Auditing Process questions in the Certsqill CISA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISA? Take the free 5-min readiness check →

1. Disclose the conflict and assess whether safeguards: What is the most appropriate action?

Medium
During a regional bank audit, the auditor discovers a personal relationship with the privileged-access control owner. The relationship could influence judgment. What is the most appropriate action?
  1. Disclose the conflict and assess whether safeguards preserve independence. ✓
    Disclosure and safeguard assessment address independence before affected audit judgments continue.
  2. Ask the control owner to confirm the auditor’s impartiality.
    The subject of the conflict cannot independently establish the auditor’s objectivity.
  3. Continue and disclose the relationship in working papers.
    Documentation alone does not protect objectivity when personal influence remains possible.
  4. Let management decide whether the auditor may continue the engagement.
    Management cannot authorize compromised professional judgment or assume auditor responsibility.
The trap
Treats disclosure as sufficient protection Relies on management confirmation Transfers independence responsibility to management

The auditor must disclose the conflict and verify that safeguards preserve independent judgment.

2. Absence of monitoring and review for emergency privileged: Which gap is most consequential for the defined ass

Hard
A healthcare network review covers confidentiality and availability of electronic patient records. The auditor finds outdated procedures, incomplete privileged-access recertifications, and no review of emergency accounts. Which gap is most consequential for the defined assessment scope?
  1. Minor inconsistencies between the network’s policy titles and assessment workpapers
    Title inconsistencies do not materially threaten confidentiality or availability directly.
  2. Absence of monitoring and review for emergency privileged accounts ✓
    Unreviewed emergency privileges can enable unauthorized access to patient records.
  3. Outdated procedures that do not reflect current terminology
    Terminology weaknesses matter less than unchecked access to sensitive records.
  4. Incomplete recertification evidence for ordinary user accounts
    Incomplete evidence is concerning, but emergency privileges present greater exposure.
The trap
Prioritizes documentation appearance Confuses administrative inconsistency with risk Overlooks higher-risk privileged access

Unmonitored emergency privileges create the most direct confidentiality risk within the assessment scope.

3. Rank auditable areas by impact and likelihood before: Before detailed fieldwork begins, what should the audito

Hard
A public agency audit team has completed interviews, reviewed prior findings, identified business objectives, and documented current risks. Before detailed fieldwork begins, what should the auditor do next to support risk-based planning?
  1. Start testing the easiest available control population.
    Convenience testing ignores documented risk and may misdirect audit resources.
  2. Rank auditable areas by impact and likelihood before allocating detailed procedures. ✓
    Risk ranking converts objectives and documented risks into focused audit work.
  3. Issue the final report before fieldwork confirms the documented risks and controls.
    Reporting before testing prevents sufficient evidence and reliable conclusions.
  4. Ask management to select procedures, testing priorities, and audit conclusions.
    Management provides information but cannot determine independent audit judgments.
The trap
Chooses convenience over risk. Surrenders auditor responsibility. Reports without sufficient evidence.

Risk ranking should precede detailed procedures so effort addresses highest exposures.

4. Reject it because acknowledgements do not directly prevent: What is the auditor’s best evaluation of this resp

Hard
An energy supplier faces unauthorized remote switching of substations. Management proposes annual policy training and signed acknowledgements, claiming these controls address the risk. What is the auditor’s best evaluation of this response?
  1. Accept it because training is always a preventive control
    Training classification does not establish that the control addresses this risk.
  2. Reject it because acknowledgements do not directly prevent remote switching ✓
    The proposed response does not adequately address the specified unauthorized-switching risk.
  3. Replace it with an auditor-operated remote-switch approval process
    Auditors recommend improvements but must not assume operational control ownership.
  4. Accept it because management alone determines control adequacy
    Management owns controls, while the auditor independently evaluates their adequacy.
The trap
Relies on control label Confuses ownership with evaluation Auditor implements management control

Training acknowledgement does not sufficiently prevent or detect unauthorized remote switching.

5. Evaluate deviation patterns and determine whether expanded: What conclusion best supports engagement managemen

Medium
During a telecommunications engagement, the auditor sampled 25 access changes from a complete population and found four deviations. Management says the exceptions are isolated. What conclusion best supports engagement management?
  1. Ignore the deviations because the sample was not statistically selected
    Nonstatistical testing still requires evaluating identified deviations and their implications.
  2. Allow management to classify the exceptions without further auditor assessment
    Management input matters, but auditors independently evaluate exceptions and conclusions.
  3. Conclude the control failed for the entire population
    A sample result alone does not automatically establish universal population failure.
  4. Evaluate deviation patterns and determine whether expanded procedures are necessary ✓
    The auditor must assess frequency, significance, and need for additional evidence.
The trap
Overgeneralizes sample deviations Delegates audit judgment Dismisses meaningful exceptions

Deviations require evaluation of patterns and significance before deciding whether more testing is needed.

6. The control appears suitably designed: What does the evidence establish?

Easy
A research organization’s policy requires monthly manager review of privileged access. The auditor verified the approval workflow and obtained screenshots, but only one month’s completed review record was available. What does the evidence establish?
  1. The control appears suitably designed, but yearly operation remains unproven ✓
    Workflow evidence supports design; one record cannot establish period-wide operation.
  2. The control is ineffective because screenshots cannot support any conclusion
    Screenshots may support evidence when relevant and appropriately corroborated.
  3. The control is unnecessary because privileged access was not misused
    Absence of detected misuse does not eliminate the preventive review requirement.
  4. The control operated effectively throughout the year
    One completed record cannot demonstrate operation across the relevant period.
The trap
Overstates limited operating evidence Confuses no incident with no control Rejects potentially relevant evidence

The evidence supports design adequacy but is insufficient to establish operating effectiveness over time.

7. Obtain alternative reliable records or disclose: What recommendation is most appropriate before concluding on

Easy
At a distribution center, the supervisor states that receiving scans are always completed, but system logs for two months are unavailable and observation occurred only once. What recommendation is most appropriate before concluding on the control?
  1. Conclude the control operates effectively based on supervisor inquiry
    Inquiry alone cannot substantiate consistent operation over two missing months.
  2. Obtain alternative reliable records or disclose the evidence limitation ✓
    Additional corroboration or transparent limitation reporting is necessary for reliability.
  3. Require the supervisor to recreate all missing scan records
    Recreated records may not reliably represent historical control operation.
  4. Recommend disciplinary action before validating the missing evidence
    The auditor should validate facts before recommending responses to possible failures.
The trap
Relies on unsupported inquiry Creates retrospective evidence Acts before fact validation

Missing records require corroboration or transparent limitation reporting before a control conclusion.

8. Use flags, disclose limitations, and avoid population-wide: How should the auditor characterize the resulting

Hard
A transport operator’s analytics review covered all available fuel transactions and flagged duplicate vendors and unusual weekend purchases. Cash purchases were excluded, and missing fields remain unresolved. How should the auditor characterize the resulting assurance?
  1. Reject the analytics entirely because excluded transactions prevent any useful conclusion.
    Partial data can still produce useful indicators when limitations are disclosed.
  2. Use flags, disclose limitations, and avoid population-wide assurance. ✓
    Incomplete data limits conclusions, while exceptions remain useful investigative indicators.
  3. Report unusual weekend purchases as confirmed control violations.
    An unusual pattern is not necessarily a confirmed control violation.
  4. Treat every duplicate vendor as evidence that fraud occurred.
    Duplicate vendors require investigation and do not automatically establish fraudulent activity.
The trap
Treats anomalies as proven fraud. Converts indicators into confirmed findings. Rejects useful analysis despite known limitations.

Incomplete analytics support investigation, but not unrestricted population-wide assurance.

9. The client’s accountable risk committee: Who should receive the formal accountability communication?

Hard
An outsourced service provider missed a remediation deadline for a control finding. The provider blames the client’s contract owner, while the client’s risk committee has authority to accept residual risk. Who should receive the formal accountability communication?
  1. The auditor’s internal quality reviewer
    Quality reviewers assess audit work, not the client’s operational risk decisions.
  2. The provider’s technical team alone
    The provider may perform remediation, but does not own client risk acceptance.
  3. The client’s accountable risk committee ✓
    The risk committee owns acceptance decisions and should receive formal accountability.
  4. The contract owner alone, without notifying risk decision-makers
    Excluding authorized risk decision-makers impairs informed accountability and escalation.
The trap
Omits authorized decision rights Misroutes management accountability Confuses service delivery with accountability

Formal communication belongs with the client body authorized to accept residual risk.

10. Review the high-impact payroll workpaper first: Which priority best follows risk-based quality assurance?

Medium
After a merger, internal audit has one week for a quality review. Two workpapers concern payroll interfaces: one has high business impact and inconsistent evidence; three lower-risk workpapers are well documented. Which priority best follows risk-based quality assurance?
  1. Review the high-impact payroll workpaper first ✓
    Quality review should prioritize higher-risk work with questionable evidence.
  2. Review the longest workpaper first for efficiency
    Workpaper length does not determine risk or quality-review priority.
  3. Review only the well-documented workpapers to confirm consistency
    Lower-risk files provide less value than scrutinizing uncertain high-impact evidence.
  4. Rewrite the payroll workpaper to correct its deficiencies
    Quality assurance evaluates and recommends improvements rather than taking over audit work.
The trap
Performs audit-team remediation Uses document size as proxy Avoids the highest-risk work

Limited review time should target high-impact work with inconsistent supporting evidence.

11. Disclose and address the relationship before performing: Which gap is most consequential to audit quality?

Hard
A software provider’s charter authorizes an access-control audit. The lead auditor’s sibling became the client’s security director last month. Evidence also shows several outdated access reviews and complete audit access. Which gap is most consequential to audit quality?
  1. Proceed independently because the charter provides unrestricted access and reporting authority.
    Authority and access do not eliminate a personal conflict of interest.
  2. Test the outdated access reviews before considering the relationship.
    This prioritizes control evidence while overlooking a direct objectivity threat.
  3. Expand testing because outdated reviews could increase operational exposure.
    Additional testing cannot resolve an undisclosed personal conflict.
  4. Disclose and address the relationship before performing further audit work. ✓
    The relationship threatens independence and must be addressed before continued evaluation.
The trap
It confuses mandate with impartiality. It treats independence as a secondary concern. More testing does not restore objectivity.

Undisclosed relationships threaten auditor objectivity before control testing continues.

12. Corroborate responses by examining records and observing: What should the auditor do next?

Medium
For an online marketplace assessment, management approved the scope, objectives, and criteria. The auditor completed interviews and reviewed a control questionnaire. No transaction records or observed procedures have been examined. What should the auditor do next?
  1. Ask management to certify that questionnaire responses remain complete and accurate.
    Certification does not replace independent evidence collection and corroboration.
  2. Issue a preliminary conclusion based on management interviews.
    Interviews alone provide insufficient evidence for a reliable conclusion.
  3. Redefine the engagement as a compliance review before testing.
    The approved objectives do not require an unplanned scope change.
  4. Corroborate responses by examining records and observing relevant procedures. ✓
    Records and observation provide evidence beyond preliminary management assertions.
The trap
It changes scope without identified need. It relies on representation instead of testing. It accepts inquiry without corroboration.

After inquiry, corroborate assertions using records and observed procedures.

510 more Information Systems Auditing Process questions

The remaining 510 questions in this domain are part of the full CISA bank — 2900 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your CISA readiness — free

Other CISA domains

Part of the Certsqill CISA question bank · Information Systems Auditing Process · Every answer, right and wrong, comes with its own explanation.