Audit vs. Assessment
1. An IS auditor is asked to review a cloud‑based ERP system. The engagement is described as an “assessment” rather than an “audit.” Which of the following is NOT a characteristic that distinguishes this assessment from a formal audit?
A. The assessment is less formal and focuses on improvement opportunities.
B. The assessment provides independent assurance with a formal opinion.
C. The assessment is typically narrower in scope.
D. The assessment may not be bound by a specific compliance framework.
Answer:
2. A manager requests a “control review” of a new application. Which of the following is LEAST likely to be a feature of this review compared with a full audit?
A. A formal, evidence‑driven opinion.
B. A focus on identifying weaknesses and risks.
C. A lighter, improvement‑oriented approach.
D. A scope that may be limited to specific controls.
Answer:
3. During a security assessment, the team uses a checklist to verify compliance with internal standards. Which of the following statements about this activity is FALSE?
A. The activity is an internal evaluation of compliance.
B. The activity provides the same level of assurance as a statutory audit.
C. The activity may identify vulnerabilities and risks.
D. The activity is less formal than an audit.
Answer:
4. An IS auditor is planning either an audit or an assessment. Which of the following is NOT a factor that should influence the choice between the two?
A. The desired level of assurance.
B. The formality of the final report.
C. The color of the audit team’s laptop bags.
D. The applicable standards or frameworks.
Answer:
5. Which of the following is NEITHER an audit NOR an assessment?
A. A compliance review against ISO 27001.
B. A control self‑assessment workshop.
C. A penetration test.
D. A financial statement audit.
Answer:
6. An organization claims it has conducted an “audit” of its data center. Which of the following would MOST likely indicate that the engagement was actually an assessment?
A. The engagement produced a formal audit opinion.
B. The engagement was evidence‑driven and independent.
C. The engagement focused on improvement opportunities and was less formal.
D. The engagement was performed by external auditors.
Answer
7. Which of the following is NOT a typical difference between an audit and an assessment?
A. An audit provides independent assurance; an assessment may not.
B. An audit is always performed by external parties; an assessment is always internal.
C. An audit is more formal; an assessment is less formal.
D. An audit is evidence‑driven; an assessment may rely on checklists.
Answer:
8. A CISA candidate is asked to classify a “readiness assessment” conducted before a formal audit. Which of the following is LEAST accurate?
A. It reviews control design to close gaps in advance.
B. It delivers a hard audit opinion.
C. It is lighter than a full audit.
D. It focuses on improvement.
Answer:
9. Which of the following statements about assurance is NOT true?
A. Audits provide a high level of assurance.
B. Assessments and reviews typically provide a lower level of assurance.
C. Assurance can only be provided by external auditors.
D. Assurance is a measure of confidence in the conclusions.
Answer:
10. An IS auditor is asked to “review” a process. Which of the following is NOT a likely outcome of this review?
A. A formal audit opinion.
B. Recommendations for improvement.
C. Identification of control weaknesses.
D. A report to management.
Answer
11. Which of the following is ALL of the following EXCEPT a factor that distinguishes an audit from an assessment?
A. Level of assurance.
B. Degree of formality.
C. Use of evidence.
D. The auditor’s favorite color.
Answer:
12. A client asks for a “light‑touch review.” Which of the following is NOT something the IS auditor should assume?
A. The engagement will be less formal.
B. The engagement will focus on improvement.
C. The engagement will automatically produce a formal audit opinion.
D. The engagement may have a narrower scope.
Answer:
13. Which of the following is NEITHER an audit NOR an assessment?
A. A control self‑assessment.
B. A compliance audit.
C. A vulnerability scan.
D. An operational audit.
Answer:
14. An IS auditor is told that a “gap assessment” was performed. Which of the following is MOST likely NOT a characteristic of that assessment?
A. It compared current state to a desired framework.
B. It produced a formal audit opinion.
C. It identified areas for improvement.
D. It was less formal than a full audit.
Answer:
15. Which of the following is NOT a valid reason to choose an assessment over an audit?
A. The organization wants a quick, improvement‑focused review.
B. The organization needs a formal, independent opinion for regulators.
C. The organization wants to prepare for a future audit.
D. The organization wants to raise risk awareness among staff.
Answer:
Audit Roles
16. An IS auditor is asked to design and implement a new access control system and then audit it. Which of the following is the MOST appropriate response?
A. Accept, because the auditor has the necessary expertise.
B. Decline, because designing and auditing the same controls violates independence.
C. Accept, but only if the audit is performed by a junior auditor.
D. Decline, because auditors should never provide any advice.
Answer:
17. Which of the following is NOT a typical role of an IS auditor?
A. Evaluating the effectiveness of controls.
B. Designing controls for a new system.
C. Providing assurance on information assets.
D. Reporting findings to management.
Answer:
18. An auditor who previously managed the IT department is assigned to audit that same department. Which of the following is LEAST appropriate?
A. The auditor should disclose the prior role.
B. The auditor should proceed without disclosure because the prior role is irrelevant.
C. Audit management should assess whether independence is impaired.
D. The auditor may need to be removed from the engagement.
Answer:
19. Which of the following is NOT a responsibility of the audit committee?
A. Approving the audit charter.
B. Ensuring the independence of the audit function.
C. Designing and operating internal controls.
D. Overseeing the audit function.
Answer: .
20. An IS auditor is a member of an application project team but has no operational responsibilities. Which of the following is MOST accurate?
A. Independence is automatically impaired.
B. Independence is not impaired solely by project team membership without operational duties.
C. The auditor must resign from the audit team.
D. The auditor can never audit that application.
Answer:
21. Which of the following is ALL of the following EXCEPT a way an IS auditor can maintain independence?
A. Avoiding operational responsibilities.
B. Reporting to the audit committee.
C. Accepting gifts from the auditee.
D. Declaring conflicts of interest.
Answer: .
22. An auditor is asked to provide consulting advice on good practices for a new system. Which of the following is NOT true?
A. Providing advice on known good practices does not automatically impair independence.
B. The auditor should avoid making management decisions.
C. The auditor can design the controls and then audit them.
D. The auditor should document the nature of the advice.
Answer: .
23. Which of the following is NEITHER an audit role NOR a management role?
A. Evaluating controls.
B. Designing controls.
C. Operating controls.
D. Facilitating a control self‑assessment workshop.
Answer:
24. An IS auditor discovers that a colleague has a financial interest in a vendor being audited. Which of the following is the LEAST appropriate action?
A. Report the conflict to audit management.
B. Ignore the conflict because it is personal.
C. Assess whether the colleague should be removed from the engagement.
D. Document the conflict.
Answer
25. Which of the following is NOT a legitimate reason for an IS auditor to decline an engagement?
A. The auditor lacks the required skills.
B. The auditor has a conflict of interest.
C. The auditor is too busy.
D. The auditor previously designed the controls being audited.
Answer:
26. An auditor is asked to audit a system that they helped implement. Which of the following is MOST appropriate?
A. Proceed without disclosure because the implementation was years ago.
B. Disclose the prior involvement and let management decide.
C. Proceed because the auditor is the only one with expertise.
D. Decline the engagement or disclose the conflict to audit management.
Answer:
27. Which of the following is ALL of the following EXCEPT a characteristic of an effective audit charter?
A. It states the authority and responsibilities of the audit function.
B. It is approved at the highest level of management.
C. It includes detailed audit procedures.
D. It defines the scope of the audit function.
Answer:
28. An IS auditor is asked to “help” management by taking responsibility for a control. Which of the following is the LEAST appropriate response?
A. Decline because it would impair independence.
B. Accept because it is only a temporary arrangement.
C. Explain that auditors should not assume operational responsibilities.
D. Escalate the request to audit management.
Answer:
29. Which of the following is NOT a role of an IS auditor in a control self‑assessment (CSA) program?
A. Facilitating workshops.
B. Taking ownership of the controls.
C. Helping process owners define controls.
D. Providing guidance on assessment techniques.
Answer:
30. An auditor is offered a bonus by the auditee for a “job well done.” Which of the following is MOST appropriate?
A. Accept the bonus because it is a sign of appreciation.
B. Decline the bonus because it may impair independence.
C. Accept the bonus but disclose it in the report.
D. Accept the bonus only if it is small.
Answer:
Organizational Policies
31. An IS auditor is verifying IT policies and finds that some policies have not been approved by management, yet employees follow them strictly. Which of the following is the MOST appropriate conclusion?
A. The policies are effective because they are followed.
B. The lack of approval is a control weakness.
C. The auditor should ignore the lack of approval.
D. The auditor should recommend that employees stop following the policies.
Answer:
32. Which of the following is NOT a characteristic of a well‑designed organizational policy?
A. It is high‑level and states management intent.
B. It is mandatory.
C. It includes step‑by‑step procedures.
D. It is approved by management.
Answer:
33. An auditor finds that a policy has not been updated for five years. Which of the following is LEAST likely to be a concern?
A. The policy may not reflect current risks.
B. The policy may be inconsistent with current technology.
C. The policy’s font is outdated.
D. The policy may not comply with new regulations.
Answer:
34. Which of the following is ALL of the following EXCEPT a reason why organizational policies are important?
A. They provide management direction.
B. They set mandatory requirements.
C. They replace the need for audits.
D. They support consistent decision‑making.
Answer:
35. An IS auditor is reviewing a policy that says “all data must be encrypted.” Which of the following is MOST likely missing from this policy?
A. A clear statement of scope and responsibilities.
B. A list of encryption algorithms.
C. Detailed implementation steps.
D. A glossary of terms.
Answer:
36. Which of the following is NEITHER a policy NOR a procedure?
A. “All employees must complete security awareness training annually.”
B. “To request access, complete Form A and submit it to the help desk.”
C. “The organization’s risk appetite is low.”
D. “Passwords must be at least 12 characters.”
Answer:
37. An auditor finds that a policy exists but employees are unaware of it. Which of the following is the MOST appropriate recommendation?
A. Delete the policy because it is not used.
B. Improve communication and training on the policy.
C. Ignore the issue because the policy exists.
D. Increase penalties for non‑compliance.
Answer:
38. Which of the following is NOT a valid source of organizational policy?
A. Regulatory requirements.
B. Management direction.
C. An auditor’s personal preference.
D. Industry best practices.
Answer:
39. An IS auditor is asked to write a policy for the IT department. Which of the following is the LEAST appropriate action?
A. Decline because policy‑making is a management responsibility.
B. Draft the policy and submit it for management approval.
C. Provide advice on policy content.
D. Explain that the auditor can facilitate but not own the policy.
Answer:
40. Which of the following is ALL of the following EXCEPT a component of a policy framework?
A. Policy.
B. Standard.
C. Procedure.
D. Audit report.
Answer:
41. An auditor finds that a policy conflicts with a regulation. Which of the following is the MOST appropriate action?
A. Ignore the conflict because the policy is internal.
B. Report the conflict to management and recommend alignment.
C. Recommend that the regulation be changed.
D. Document the conflict but take no further action.
Answer:
42. Which of the following is NOT a good practice for policy maintenance?
A. Regular review and update.
B. Version control.
C. Storing policies only on paper.
D. Management approval of changes.
Answer:
43. An IS auditor is evaluating whether a policy is “effective.” Which of the following is LEAST relevant?
A. The policy is communicated to all staff.
B. The policy is enforced.
C. The policy document is aesthetically pleasing.
D. The policy is reviewed periodically.
Answer:
44. Which of the following is NEITHER a policy NOR a standard?
A. “Access to production data requires manager approval.”
B. “Passwords must be changed every 90 days.”
C. “The organization will adopt a risk‑based approach to security.”
D. “Firewalls must be configured to deny all traffic by default.”
Answer
45. An auditor finds that a policy has no owner. Which of the following is the MOST appropriate concern?
A. The policy may not be enforced.
B. The policy may be too long.
C. The policy may use complex language.
D. The policy may not be printed.
Answer:
Auditor Independence
46. An IS auditor’s independence is questioned because they previously worked for the auditee. Which of the following is LEAST appropriate?
A. Disclose the prior relationship.
B. Proceed without any disclosure.
C. Assess whether the prior role impairs objectivity.
D. Consider removing the auditor from the engagement.
Answer:
47. Which of the following is NOT a threat to auditor independence?
A. Self‑review threat.
B. Self‑interest threat.
C. Advocacy threat.
D. Auditor’s competence.
Answer:.
48. An auditor is asked to audit a system they designed. Which of the following is MOST accurate?
A. Independence is impaired due to self‑review.
B. Independence is not impaired if the auditor is competent.
C. Independence is impaired only if the auditor is paid extra.
D. Independence is not a concern for internal auditors.
Answer:
49. Which of the following is ALL of the following EXCEPT a way to mitigate threats to independence?
A. Rotating auditors.
B. Independent review of work.
C. Increasing the auditor’s salary.
D. Disclosing conflicts of interest.
Answer:
50. An auditor’s spouse is the CFO of the auditee. Which of the following is the LEAST appropriate action?
A. Disclose the relationship.
B. Continue the audit without disclosure.
C. Remove the auditor from the engagement.
D. Assess the threat to independence.
Answer: .
51. Which of the following is NEITHER a threat to independence NOR a safeguard?
A. Self‑interest threat.
B. Audit committee oversight.
C. Auditor’s favorite color.
D. Familiarity threat.
Answer:
52. An IS auditor is offered a gift by the auditee. Which of the following is MOST appropriate?
A. Accept the gift if it is of low value.
B. Decline the gift and document the offer.
C. Accept the gift and disclose it in the report.
D. Accept the gift because it is customary.
Answer:
53. Which of the following is NOT a component of independence?
A. Independence in fact.
B. Independence in appearance.
C. Independence in reporting.
D. Independence in compensation.
Answer:
54. An auditor reports to the IT manager they are auditing. Which of the following is the MOST significant concern?
A. The auditor may not have enough budget.
B. Organizational independence is impaired.
C. The auditor may not have the right software.
D. The auditor may not have a desk.
Answer:
55. Which of the following is ALL of the following EXCEPT a safeguard that can protect auditor independence?
A. Reporting to the audit committee.
B. Rotation of audit staff.
C. Auditor participating in operational decisions.
D. Independent quality reviews.
Answer:
56. An auditor is asked to provide an opinion on a system they helped implement. Which of the following is LEAST appropriate?
A. Disclose the prior involvement.
B. Proceed without disclosure because the implementation was successful.
C. Consider whether a different auditor should perform the review.
D. Document the self‑review threat.
Answer: .
57. Which of the following is NOT a reason why auditor independence is important?
A. It enhances the credibility of audit findings.
B. It ensures the auditor can make objective judgments.
C. It allows the auditor to design controls.
D. It supports public confidence in the audit function.
Answer:
58. An auditor’s independence is questioned after they accept a consulting engagement with the auditee. Which of the following is the MOST appropriate response?
A. Ignore the issue because consulting is allowed.
B. Assess the threat and disclose it to audit management.
C. Proceed with the audit without any changes.
D. Cancel the audit immediately.
Answer:
59. Which of the following is NEITHER an independence threat NOR a safeguard?
A. Intimidation threat.
B. Audit committee oversight.
C. Auditor’s hobby.
D. Self‑review threat.
Answer:
60. An auditor is asked to audit a process they previously managed. Which of the following is LEAST appropriate?
A. Disclose the prior role.
B. Proceed because enough time has passed.
C. Assess whether independence is impaired.
D. Consider rotating the auditor.
Answer:
Assurance Methods
61. An IS auditor needs evidence about the population of transactions. Which of the following methods is LEAST appropriate for obtaining population coverage?
A. CAATs (full data).
B. Sampling.
C. Inquiry alone.
D. Reperformance.
Answer:
62. Which of the following is NOT a valid assurance method?
A. Observation.
B. Inquiry.
C. Reperformance.
D. Guessing.
Answer:
63. An auditor wants to verify that a control is operating effectively. Which of the following methods provides the LEAST direct evidence?
A. Observation.
B. Reperformance.
C. Inquiry.
D. Inspection of documentation.
Answer:
64. Which of the following is ALL of the following EXCEPT a type of audit evidence?
A. Physical evidence.
B. Testimonial evidence.
C. Documentary evidence.
D. Auditor’s opinion.
Answer:
65. An IS auditor needs to test 100% of transactions. Which of the following methods is MOST appropriate?
A. Sampling.
B. CAATs.
C. Inquiry.
D. Observation.
Answer:
66. Which of the following is NOT a characteristic of reliable audit evidence?
A. Sufficiency.
B. Appropriateness.
C. Convenience.
D. Relevance.
Answer:.
67. An auditor relies solely on management’s oral representations. Which of the following is the MOST significant weakness?
A. Oral evidence is the most reliable.
B. Oral evidence is the least reliable and should be corroborated.
C. Oral evidence is always sufficient.
D. Oral evidence is preferred over documentation.
Answer: .
68. Which of the following is NEITHER a sampling method NOR an evidence‑gathering technique?
A. Discovery sampling.
B. Systematic sampling.
C. Reperformance.
D. Brainstorming.
Answer:
69. An IS auditor wants to determine whether a fraud has occurred. Which sampling method is MOST appropriate?
A. Attribute sampling.
B. Discovery sampling.
C. Variable sampling.
D. Stop‑or‑go sampling.
Answer:
70. Which of the following is ALL of the following EXCEPT a factor that affects the sufficiency of evidence?
A. Risk of material misstatement.
B. Quality of evidence.
C. Auditor’s mood.
D. Size of the population.
Answer:
71. An auditor uses observation to assess a control. Which of the following is NOT a limitation of observation?
A. The control may be performed differently when not observed.
B. Observation provides direct evidence.
C. Observation is limited to the period observed.
D. Observation cannot reveal whether the control was performed consistently.
Answer:
72. Which of the following is NOT a valid assurance method for verifying the accuracy of a calculation?
A. Reperformance.
B. CAATs.
C. Inquiry.
D. Analytical procedures.
Answer:
73. An IS auditor needs evidence about how a process operates in practice. Which of the following is the MOST appropriate method?
A. Inquiry.
B. Observation.
C. Inspection of a policy manual.
D. Review of prior audit reports.
Answer:
74. Which of the following is NEITHER an audit evidence source NOR an assurance method?
A. Confirmation.
B. Analytical procedures.
C. Auditor’s intuition.
D. Recalculation.
Answer:
75. An auditor is evaluating the reliability of evidence obtained from an independent third party. Which of the following is MOST accurate?
A. Third‑party evidence is generally more reliable than internal evidence.
B. Third‑party evidence is always less reliable.
C. Third‑party evidence is never sufficient.
D. Third‑party evidence is irrelevant.
Answer: .
76. Which of the following is ALL of the following EXCEPT a characteristic of appropriate audit evidence?
A. Relevance.
B. Reliability.
C. Timeliness.
D. Volume.
Answer:
77. An auditor uses a checklist to assess compliance. Which of the following is LEAST likely to be a limitation of this method?
A. The checklist may be incomplete.
B. The checklist provides a formal audit opinion.
C. The checklist may not capture nuances.
D. The checklist may be subjective.
Answer:
78. Which of the following is NOT an assurance method?
A. Walk‑through.
B. Reperformance.
C. Observation.
D. Speculation.
Answer:
79. An IS auditor is selecting an assurance method. Which of the following is LEAST important to consider?
A. The nature of the control being tested.
B. The availability of evidence.
C. The auditor’s personal preference.
D. The level of assurance required.
Answer:
80. Which of the following is NEITHER a sampling risk NOR a non‑sampling risk?
A. Risk that a sample is not representative.
B. Risk that the auditor reaches a wrong conclusion due to factors other than sampling.
C. Risk that the auditor’s coffee is cold.
D. Risk that the auditor fails to recognize a control deviation.
Answer:
81. An auditor uses inquiry and observation to gather evidence. Which of the following is MOST accurate about these methods?
A. They are the most reliable forms of evidence.
B. They are often used together to corroborate each other.
C. They are sufficient on their own for a formal audit opinion.
D. They are not considered audit evidence.
Answer:
82. Which of the following is ALL of the following EXCEPT a valid technique for testing controls?
A. Reperformance.
B. Observation.
C. Inquiry.
D. Ignoring the control.
Answer:
83. An auditor needs to verify that a report was generated correctly. Which of the following methods provides the BEST evidence?
A. Inquiry with the report owner.
B. Reperformance of the report logic.
C. Observation of the report being printed.
D. Review of the report’s cover page.
Answer:
84. Which of the following is NOT a type of audit sampling?
A. Statistical sampling.
B. Non‑statistical sampling.
C. Judgmental sampling.
D. Random guessing.
Answer:
85. An IS auditor is assessing the effectiveness of a control. Which of the following is LEAST likely to be used as evidence?
A. System logs.
B. Interviews with staff.
C. The auditor’s personal opinion without documentation.
D. Configuration files.
Answer:
86. Which of the following is NEITHER an audit procedure NOR an assurance method?
A. Inspection.
B. Confirmation.
C. Recalculation.
D. Daydreaming.
Answer:
87. An auditor uses CAATs to test a full population. Which of the following is MOST accurate?
A. CAATs eliminate the need for professional judgment.
B. CAATs can provide complete population coverage.
C. CAATs are always less reliable than sampling.
D. CAATs are only useful for small populations.
Answer:
88. Which of the following is ALL of the following EXCEPT a factor that influences the reliability of evidence?
A. Independence of the source.
B. Effectiveness of internal controls.
C. Auditor’s physical attractiveness.
D. Qualifications of the provider.
Answer:
89. An auditor wants to confirm a balance with a third party. Which of the following is the MOST appropriate method?
A. Inquiry.
B. Confirmation.
C. Observation.
D. Reperformance.
Answer:
90. Which of the following is NOT a limitation of inquiry as an evidence‑gathering method?
A. The respondent may be biased.
B. The respondent may not know the answer.
C. Inquiry provides direct evidence of control operation.
D. Inquiry alone is rarely sufficient.
Answer: .
91. An auditor is evaluating the sufficiency of evidence. Which of the following is LEAST relevant?
A. The risk of material misstatement.
B. The quality of the evidence.
C. The auditor’s lunch break.
D. The size of the population.
Answer: .
92. Which of the following is NEITHER a test of controls NOR a substantive test?
A. Reperformance of a control.
B. Analytical procedures.
C. Inquiry about a control.
D. Reviewing a policy manual for fun.
Answer:
93. An IS auditor needs to determine whether a control is designed effectively. Which of the following methods is MOST appropriate?
A. Observation of the control in operation.
B. Inquiry with the control owner.
C. Review of the control design documentation.
D. Reperformance of the control.
Answer:
94. Which of the following is ALL of the following EXCEPT a valid source of audit evidence?
A. External confirmations.
B. Internal documents.
C. Oral representations.
D. The auditor’s dreams.
Answer: .
95. An auditor uses a walk‑through to understand a process. Which of the following is MOST accurate?
A. A walk‑through is a form of reperformance.
B. A walk‑through typically combines inquiry, observation, and inspection.
C. A walk‑through provides a formal audit opinion.
D. A walk‑through is only used for financial audits.
Answer:
96. Which of the following is NOT a characteristic of appropriate evidence?
A. It is relevant to the audit objective.
B. It is reliable.
C. It is sufficient.
D. It is colorful.
Answer:.
97. An auditor is assessing the risk of fraud. Which of the following evidence‑gathering methods is LEAST useful?
A. Data analytics.
B. Discovery sampling.
C. Inquiry alone.
D. Surprise visits.
Answer:
98. Which of the following is NEITHER an assurance method NOR an audit technique?
A. Analytical review.
B. Focus groups.
C. Reperformance.
D. Inspection.
Answer:
99. An IS auditor is evaluating the reliability of evidence from a system‑generated report. Which of the following is MOST important to consider?
A. The report’s font size.
B. Whether the system’s controls are reliable.
C. The color of the report.
D. The number of pages.
Answer:
100. Which of the following is ALL of the following EXCEPT a valid assurance method for obtaining evidence about control effectiveness?
A. Observation.
B. Reperformance.
C. Inquiry.
D. Assuming the control works.
Answer
