case-based MCQs for CISA Domains 1 and 2, continuing the ISACA "BEST/FIRST/Risk-Based" logic.

case-based MCQs for CISA Domains 1 and 2, continuing the ISACA "BEST/FIRST/Risk-Based" logic.

SECTION A....

Domain 1: Information System Auditing Process 

Case Study: The Inventory Valuation Audit

An IS auditor is auditing a manufacturing company's inventory system. Management is concerned about obsolete stock, and the external financial auditors are relying on the IS auditor's work for inventory valuation.

Q1. The auditor wants to select a sample of inventory items for price testing. The population is 50,000 SKUs, but 200 items account for 85% of total value. Which sampling approach is MOST appropriate?

A. Simple random sampling of all 50,000 SKUs.

B. Stratified sampling, with the 200 high-value items tested 100% and a statistical sample of the remainder.

C. Discovery sampling focused on the lowest-value items.

D. Judgmental sampling selected by the warehouse manager.

Answer:

Q2. The auditor uses CAATs to extract all inventory transactions where the unit cost changed by more than 20% within a 30-day period. What type of audit procedure is this?

A. Substantive testing of account balances.

B. Test of controls over inventory pricing.

C. Analytical procedure to identify anomalous transactions.

D. Compliance testing of the change management process.

Answer:

Q3. The auditor finds that the system allows warehouse supervisors to both adjust inventory quantities and approve their own adjustments. What is the auditor's PRIMARY concern?

A. The supervisors may lack adequate training.

B. There is a segregation of duties conflict enabling concealment of theft.

C. The adjustment reports may be too large to review.

D. The system may not log adjustments in real time.

Answer:

Q4. The auditor needs to evaluate whether the inventory valuation report used as evidence is complete. The report was generated by a script written by the IT analyst responsible for the inventory system. What should the auditor do FIRST?

A. Accept the report because IT analysts are technically competent.

B. Independently validate the script logic or re-perform the extraction using auditor-controlled tools.

C. Ask the IT analyst to sign a representation letter.

D. Compare the report total to the general ledger balance.

Answer:

Case Study: The Audit Charter Dispute

A newly hired IS auditor is asked by the CFO to audit a sensitive payroll system. The IT Director objects, stating that "internal audit reports to the CFO, so auditing payroll creates a conflict." The auditor reviews the audit charter.

Q5. According to IIA/ISACA standards, what is the PRIMARY purpose of the audit charter?

A. To document the audit schedule for the year.

B. To define the audit function's purpose, authority, and responsibility.

C. To list the names of all auditable systems.

D. To establish the auditor's salary grade.

Answer: .

Q6. The auditor finds that the charter grants "unrestricted access to all records." However, the IT Director has instructed system administrators not to provide payroll data without his approval. What should the auditor do FIRST?

A. Escalate the access restriction to the audit committee.

B. Accept the restriction because payroll is sensitive.

C. Attempt to obtain the data through the CFO.

D. Document the restriction and proceed with the audit without payroll data.

Answer:

Q7. The auditor is planning the engagement and must decide whether to use the work of an external IT security consultant who performed a penetration test. Which factor is MOST important in determining whether to rely on the consultant's work?

A. The consultant's fee for the engagement.

B. The consultant's independence, competence, and objectivity.

C. Whether the consultant used automated tools.

D. The length of the final report.

Answer:

Case Study: The Emergency Change

During an audit of change management, the auditor finds that a critical production patch was applied without a change ticket. The IT manager explains: "It was a zero-day vulnerability. We had to act immediately. The ticket was created retroactively three days later."

Q8. What is the auditor's MOST appropriate conclusion?

A. This is a control failure; all changes must have pre-approval.

B. This is acceptable if a documented emergency change procedure exists with retroactive review.

C. The change should be reversed because it lacked approval.

D. The IT manager should be reprimanded for bypassing controls.

Answer:

Q9. The auditor wants to test whether emergency changes are properly reviewed after the fact. Which evidence is MOST reliable?

A. A verbal confirmation from the change manager.

B. System-generated change logs showing emergency changes and subsequent approval timestamps.

C. A memo from the IT Director stating that reviews occur.

D. The auditor's observation of a Change Advisory Board meeting.

Answer:

Case Study: Sampling and Confidence

An auditor is testing a control that approves purchase orders over $10,000. The population is 5,000 POs. The auditor wants 95% confidence and a 5% tolerable deviation rate.

Q10. The auditor selects a sample and finds 2 deviations in 60 items. What should the auditor conclude?

A. The control is effective because 2 is a small number.

B. The upper deviation limit may exceed the tolerable rate; the control cannot be relied upon as tested.

C. The sample was too large; reduce it and retest.

D. The deviations should be ignored if they were for legitimate business reasons.

Answer:

Q11. The auditor decides to use discovery sampling. In which situation is this MOST appropriate?

A. Testing whether purchase orders are approved.

B. Searching for a rare instance of fraud or policy violation.

C. Estimating the total dollar value of inventory.

D. Evaluating the operating effectiveness of a password policy.

Answer: 

Case Study: Reporting and Follow-Up

The auditor has finalized a report with a High-risk finding: the disaster recovery plan has never been tested. Management agrees and promises to test within 90 days.

Q12. Six months later, the auditor checks the issue tracking system. The status is still "Open." What should the auditor do NEXT?

A. Close the finding because management acknowledged it.

B. Escalate to the audit committee with the updated status.

C. Re-audit the entire DRP function from scratch.

D. Remove the finding from the historical record to avoid clutter.

Answer: 

Q13. The auditor is drafting the finding. Which component describes the "effect"?

A. The control that is missing.

B. The root cause of the deficiency.

C. The risk or impact if the deficiency is not addressed.

D. The recommended corrective action.

Answer: 

Case Study: Fraud Indicators

An auditor notices that a payroll clerk has not taken a vacation in three years and consistently refuses to cross-train others. The clerk processes all payroll for a department where a relative is a manager.

Q14. What should the auditor do FIRST?

A. Confront the clerk with the suspicion of fraud.

B. Expand testing of payroll transactions processed by this clerk for anomalies.

C. Report the clerk to law enforcement.

D. Recommend immediate termination.

Answer:

Q15. The auditor uses CAATs to identify payroll payments made to employees with no corresponding time records. This is an example of:

A. Testing the general IT controls.

B. A substantive test for existence/occurrence.

C. A test of the change management control.

D. A compliance test of the vacation policy.

Answer: 

Q16. An auditor is asked to audit a system that is being developed and is not yet in production. Which of the following is the MOST significant concern for the auditor?

A. The system may not be documented.

B. Controls may be designed but not yet operating effectively.

C. The project may be over budget.

D. Users may not have been trained.

Answer: 

Domain 2: Governance & Management of IT (Additional 16 Questions)

Case Study: Risk Response Decisions

A hospital's radiology system is running on Windows Server 2008, which no longer receives security patches. The vendor has quoted $200,000 to upgrade to a supported platform. The CISO proposes to "isolate the system behind a firewall and monitor it closely."

Q17. What risk response is the CISO proposing?

A. Avoidance

B. Transfer

C. Mitigation

D. Acceptance

Answer: 

Q18. The board decides that the upgrade is too expensive and formally signs off on continuing with the unsupported system. What is this called?

A. Residual risk

B. Inherent risk

C. Risk appetite

D. Risk acceptance

Answer: 

---

Case Study: The RACI Matrix

An organization is implementing a new data warehouse. The project manager presents a RACI chart. The CIO is marked as "Accountable" for data quality. The Data Governance Manager is marked as "Responsible."

Q19. According to RACI principles, what does "Accountable" mean?

A. The person who does the work.

B. The person who must be consulted before decisions.

C. The person who is ultimately answerable for the outcome and has veto authority.

D. The person who should be informed of progress.

Answer: 

Q20. The auditor finds that three people are marked "Accountable" for the same deliverable. What is the PRIMARY governance concern?

A. Too many people will be informed.

B. Diffused accountability may lead to no one taking ownership.

C. The project budget may be exceeded.

D. The Responsible party will be overworked.

Answer: 

Case Study: COBIT and Performance

The auditor is reviewing IT performance metrics. The CIO reports "99.9% system uptime" and "95% of projects delivered on time" as evidence of IT success.

Q21. Which of the following BEST evaluates whether these metrics demonstrate effective IT governance?

A. The metrics are sufficient if they meet industry benchmarks.

B. The auditor should determine whether these metrics are aligned with business objectives and stakeholder value.

C. The metrics are irrelevant; only financial metrics matter.

D. The auditor should verify the calculation methodology only.

Answer:

Q22. The auditor finds that IT projects are approved based on the CIO's verbal direction, with no business case. Which COBIT governance objective is MOST directly violated?

A. Ensuring IT is transparent.

B. Ensuring benefits realization and optimizing risk.

C. Ensuring resource optimization.

D. Ensuring stakeholder engagement.

Answer: 

Case Study: Third-Party Risk

A bank outsources its credit card processing to a third party. The contract states that the provider will "maintain appropriate security controls." The auditor finds no evidence of periodic independent assurance.

Q23. What is the auditor's PRIMARY concern?

A. The provider may charge too much.

B. The bank cannot verify that controls are operating effectively.

C. The contract is too short.

D. The provider may use cloud services.

Answer: 

Q24. The auditor recommends adding a "right to audit" clause. What is the BEST reason for this?

A. It allows the bank to avoid paying for assurance.

B. It provides a mechanism to obtain evidence if other assurance is insufficient.

C. It guarantees the provider will have no breaches.

D. It is required by all regulations.

Answer:

---

Case Study: Policies and Standards

An organization has a 50-page "Acceptable Use Policy" that includes detailed technical configuration standards for firewalls and specific password lengths.

Q25. What is the PRIMARY issue with this document?

A. It is too short.

B. It mixes policy (management intent) with standards/procedures (technical specifications).

C. It should be written by the IT department only.

D. It should not mention passwords.

Answer: .

Q26. The auditor finds that the firewall standard has not been updated in 4 years, but the firewall technology has changed significantly. What should the auditor recommend?

A. Delete the standard.

B. Implement a periodic review and update process for standards and procedures.

C. Outsource firewall management.

D. Move the standard into the policy document.

Answer: 

Case Study: Organizational Structure

A company has a CISO who reports to the CIO. The CISO is responsible for enforcing security policies, including restricting the CIO's access to certain sensitive systems.

Q27. What is the MOST significant organizational concern?

A. The CISO may not have enough budget.

B. The CISO lacks independence from the CIO, creating a conflict of interest.

C. The CIO may not understand security.

D. The CISO should report to the CFO instead.

Answer: 

Q28. The auditor finds that the database administrators (DBAs) also perform system backups and manage user access. Which SoD principle is violated?

A. Authorization vs. recording.

B. Custody of assets vs. reconciliation.

C. Execution vs. authorization.

D. The DBAs have incompatible access and operational responsibilities.

Answer: 

Case Study: Legal and Regulatory

A multinational company stores EU customer data in a US data center. The company has not implemented Standard Contractual Clauses or any other transfer mechanism.

Q29. Which regulation is MOST directly implicated?

A. SOX (Sarbanes-Oxley).

B. GDPR (General Data Protection Regulation).

C. HIPAA (Health Insurance Portability and Accountability Act).

D. PCI DSS (Payment Card Industry Data Security Standard).

Answer: 

Q30. The auditor finds that the company has a privacy policy but no process to handle data subject access requests (DSARs) within the legally required timeframe. What should the auditor recommend FIRST?

A. Stop collecting personal data.

B. Implement a documented DSAR intake, tracking, and response process with defined responsibilities.

C. Hire more lawyers.

D. Ignore it because enforcement is rare.

Answer: 

Q31. An auditor is assessing IT governance maturity. The organization has documented processes, but they are not consistently followed across departments. According to CMMI, what maturity level is this?

A. Level 1 (Initial).

B. Level 2 (Managed).

C. Level 3 (Defined).

D. Level 4 (Quantitatively Managed).

Answer: 

Q32. The board asks the auditor to evaluate whether IT is "doing the right things." Which of the following BEST addresses this question?

A. Reviewing the IT operational dashboard for uptime.

B. Assessing whether the IT strategy and investment portfolio are aligned with enterprise objectives.

C. Testing the effectiveness of firewall rules.

D. Reviewing the number of help desk tickets resolved.

Answer: 

SECTION B...

Domain 1: Information System Auditing Process (18%)

Case Study 1: The Third-Party CRM Audit

An IS auditor is assigned to audit a new cloud service provider hosting the organization's customer relationship management (CRM) system. The auditor has no prior knowledge of this provider. The provider has supplied a SOC 2 Type II report, but the contract lacks a "right to audit" clause.

Q1. What should be the auditor's FIRST step in planning this engagement?

A. Review the SOC 2 Type II report to identify gaps.

B. Conduct a risk assessment to determine the scope and objectives.

C. Interview the IT manager regarding the provider's performance.

D. Request the service level agreement (SLA) to check penalties.

Answer: 

Q2. During fieldwork, the auditor finds that the provider's database administrator (DBA) generated the access logs used as evidence. What is the PRIMARY concern?

A. The logs might be too large to analyze.

B. The DBA could have manipulated the logs, compromising independence.

C. The logs may not be in a readable format.

D. The DBA might charge extra for the extraction.

Answer: 

Case Study 2: The Disagreement

An auditor discovers a high-risk finding: unencrypted transmission of sensitive payroll data. The IT Manager disagrees, stating that "the firewall protects the internal network." The auditor has the packet capture evidence.

Q3. What should the auditor do NEXT?

A. Remove the finding to maintain a good relationship with management.

B. Escalate immediately to the Audit Committee without discussion.

C. Discuss the finding with the auditee, provide the packet capture evidence, and document the disagreement.

D. Lower the risk rating to "Medium" since the data is internal.

Answer: 

Domain 2: Governance & Management of IT (18%)

Case Study 3: The Steering Committee Conflict

A retail company has established an IT Steering Committee. The CIO acts as the Chairperson. The committee is responsible for approving the IT strategy and monitoring major project risks. The auditor notes that the CIO also approves project budgets and leads the execution of the strategy.

Q4. Which governance deficiency is MOST material to the auditor's assessment?

A. The absence of a balanced scorecard for IT.

B. Insufficient segregation between oversight (governance) and execution (management).

C. The committee meets only quarterly.

D. The lack of a documented RACI matrix.

Answer: 

Q5. To remediate this, which of the following is the BEST recommendation?

A. The CIO should step down from the committee, and a board-level director should chair.

B. The CIO should retain the chair but have the CISO co-sign all decisions.

C. The audit committee should take over all IT project execution.

D. The IT Steering Committee should be dissolved and replaced by the Change Advisory Board (CAB).

Answer: 

Case Study 4: COBIT & Value Delivery

An organization implemented a new ERP system three years ago. The original business case projected a 3-year payback period through inventory reduction. The auditor finds that no benefits tracking was ever performed, though the system is technically "live" and functioning.

Q6. What is the MOST appropriate audit conclusion?

A. The project failed because the payback wasn't achieved.

B. Value delivery cannot be substantiated; benefits realization controls are inadequate.

C. The project is successful because the system is operational.

D. Only the IT costs need reconciliation; business benefits are the sponsor's issue.

Answer: 

Q7. During a risk assessment, the auditor finds a legacy server with critical customer data is unpatched and has a high likelihood of exploitation. The cost to patch is $50k, but the potential loss is $2M. Management decides to accept the risk because "the server is behind a firewall." Which risk response is this?

A. Mitigate

B. Transfer

C. Avoid

D. Accept

Answer: 

Exam Trap Summary (Based on Your Notes)

· FIRST Step: Always Understand Business/Risk (Assessment) before collecting evidence or reviewing reports.

· BEST Answer: Risk-Based Approach trumps budget, schedules, or technical convenience.

· COBIT Logic: Governance (EDM) sets direction; Management (APO/BAI/DSS) executes. Never mix them.

Exam Trap Reminders (Reinforced)

· "FIRST" in audit execution: If evidence is suspect, validate the tool/process before drawing conclusions.

· "BEST" in governance: Independence and alignment with business objectives trump technical fixes.

· Sampling: Statistical > judgmental. Stratified for high-value populations. Discovery for rare events.

· RACI: One Accountable. Multiple = governance failure.

· Risk Response: Mitigation = compensating controls. Acceptance = formal sign-off, not ignoring.

case‑based, MCQs covering CISA Domain 1 – Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods.

case‑based, MCQs with answers,covering CISA Domain 1 – Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods.

Audit vs. Assessment

1. An IS auditor is asked to review a cloud‑based ERP system. The engagement is described as an “assessment” rather than an “audit.” Which of the following is NOT a characteristic that distinguishes this assessment from a formal audit?

A. The assessment is less formal and focuses on improvement opportunities.

B. The assessment provides independent assurance with a formal opinion.

C. The assessment is typically narrower in scope.

D. The assessment may not be bound by a specific compliance framework.

Answer: B – An assessment does not provide independent assurance with a formal opinion; that is a hallmark of a formal audit.

2. A manager requests a “control review” of a new application. Which of the following is LEAST likely to be a feature of this review compared with a full audit?

A. A formal, evidence‑driven opinion.

B. A focus on identifying weaknesses and risks.

C. A lighter, improvement‑oriented approach.

D. A scope that may be limited to specific controls.

Answer: A – A control review (assessment) is less formal and does not typically deliver a formal audit opinion.

3. During a security assessment, the team uses a checklist to verify compliance with internal standards. Which of the following statements about this activity is FALSE?

A. The activity is an internal evaluation of compliance.

B. The activity provides the same level of assurance as a statutory audit.

C. The activity may identify vulnerabilities and risks.

D. The activity is less formal than an audit.

Answer: B – An assessment does not provide the same high level of assurance as a formal audit.

4. An IS auditor is planning either an audit or an assessment. Which of the following is NOT a factor that should influence the choice between the two?

A. The desired level of assurance.

B. The formality of the final report.

C. The color of the audit team’s laptop bags.

D. The applicable standards or frameworks.

Answer: C – The color of laptop bags is irrelevant; the choice depends on assurance level, formality, scope, and standards.

5. Which of the following is NEITHER an audit NOR an assessment?

A. A compliance review against ISO 27001.

B. A control self‑assessment workshop.

C. A penetration test.

D. A financial statement audit.

Answer: C – A penetration test is a technical security test, not an audit or an assessment in the CISA sense.

6. An organization claims it has conducted an “audit” of its data center. Which of the following would MOST likely indicate that the engagement was actually an assessment?

A. The engagement produced a formal audit opinion.

B. The engagement was evidence‑driven and independent.

C. The engagement focused on improvement opportunities and was less formal.

D. The engagement was performed by external auditors.

Answer: C – Assessments are less formal and improvement‑focused, unlike formal audits.

7. Which of the following is NOT a typical difference between an audit and an assessment?

A. An audit provides independent assurance; an assessment may not.

B. An audit is always performed by external parties; an assessment is always internal.

C. An audit is more formal; an assessment is less formal.

D. An audit is evidence‑driven; an assessment may rely on checklists.

Answer: B – Audits can be internal or external; assessments can also be performed by external parties. The other differences are valid.

8. A CISA candidate is asked to classify a “readiness assessment” conducted before a formal audit. Which of the following is LEAST accurate?

A. It reviews control design to close gaps in advance.

B. It delivers a hard audit opinion.

C. It is lighter than a full audit.

D. It focuses on improvement.

Answer: B – A readiness assessment does not deliver a hard audit opinion; it prepares for an audit.

9. Which of the following statements about assurance is NOT true?

A. Audits provide a high level of assurance.

B. Assessments and reviews typically provide a lower level of assurance.

C. Assurance can only be provided by external auditors.

D. Assurance is a measure of confidence in the conclusions.

Answer: C – Assurance can be provided by internal or external auditors; it is not limited to external parties.

10. An IS auditor is asked to “review” a process. Which of the following is NOT a likely outcome of this review?

A. A formal audit opinion.

B. Recommendations for improvement.

C. Identification of control weaknesses.

D. A report to management.

Answer: A – A review typically does not result in a formal audit opinion.

11. Which of the following is ALL of the following EXCEPT a factor that distinguishes an audit from an assessment?

A. Level of assurance.

B. Degree of formality.

C. Use of evidence.

D. The auditor’s favorite color.

Answer: D – The auditor’s favorite color is irrelevant; the other three are legitimate distinguishing factors.

12. A client asks for a “light‑touch review.” Which of the following is NOT something the IS auditor should assume?

A. The engagement will be less formal.

B. The engagement will focus on improvement.

C. The engagement will automatically produce a formal audit opinion.

D. The engagement may have a narrower scope.

Answer: C – A light‑touch review (assessment) does not automatically produce a formal audit opinion.

13. Which of the following is NEITHER an audit NOR an assessment?

A. A control self‑assessment.

B. A compliance audit.

C. A vulnerability scan.

D. An operational audit.

Answer: C – A vulnerability scan is a technical test, not an audit or assessment.

14. An IS auditor is told that a “gap assessment” was performed. Which of the following is MOST likely NOT a characteristic of that assessment?

A. It compared current state to a desired framework.

B. It produced a formal audit opinion.

C. It identified areas for improvement.

D. It was less formal than a full audit.

Answer: B – A gap assessment does not produce a formal audit opinion; it identifies gaps.

15. Which of the following is NOT a valid reason to choose an assessment over an audit?

A. The organization wants a quick, improvement‑focused review.

B. The organization needs a formal, independent opinion for regulators.

C. The organization wants to prepare for a future audit.

D. The organization wants to raise risk awareness among staff.

Answer: B – If a formal, independent opinion is required, an audit is appropriate, not an assessment.

---

Audit Roles

16. An IS auditor is asked to design and implement a new access control system and then audit it. Which of the following is the MOST appropriate response?

A. Accept, because the auditor has the necessary expertise.

B. Decline, because designing and auditing the same controls violates independence.

C. Accept, but only if the audit is performed by a junior auditor.

D. Decline, because auditors should never provide any advice.

Answer: B – Designing and then auditing the same controls creates a self‑review threat and impairs independence.

17. Which of the following is NOT a typical role of an IS auditor?

A. Evaluating the effectiveness of controls.

B. Designing controls for a new system.

C. Providing assurance on information assets.

D. Reporting findings to management.

Answer: B – Designing controls is a management responsibility; auditors should not design the controls they later audit.

18. An auditor who previously managed the IT department is assigned to audit that same department. Which of the following is LEAST appropriate?

A. The auditor should disclose the prior role.

B. The auditor should proceed without disclosure because the prior role is irrelevant.

C. Audit management should assess whether independence is impaired.

D. The auditor may need to be removed from the engagement.

Answer: B – Prior operational responsibility can impair independence and must be disclosed and assessed.

19. Which of the following is NOT a responsibility of the audit committee?

A. Approving the audit charter.

B. Ensuring the independence of the audit function.

C. Designing and operating internal controls.

D. Overseeing the audit function.

Answer: C – Designing and operating controls is management’s responsibility; the audit committee oversees the audit function.

20. An IS auditor is a member of an application project team but has no operational responsibilities. Which of the following is MOST accurate?

A. Independence is automatically impaired.

B. Independence is not impaired solely by project team membership without operational duties.

C. The auditor must resign from the audit team.

D. The auditor can never audit that application.

Answer: B – Participation as a project team member without operational responsibility does not necessarily impair independence.

21. Which of the following is ALL of the following EXCEPT a way an IS auditor can maintain independence?

A. Avoiding operational responsibilities.

B. Reporting to the audit committee.

C. Accepting gifts from the auditee.

D. Declaring conflicts of interest.

Answer: C – Accepting gifts from the auditee impairs independence; the other actions support independence.

22. An auditor is asked to provide consulting advice on good practices for a new system. Which of the following is NOT true?

A. Providing advice on known good practices does not automatically impair independence.

B. The auditor should avoid making management decisions.

C. The auditor can design the controls and then audit them.

D. The auditor should document the nature of the advice.

Answer: C – Designing controls and then auditing them creates a self‑review threat.

23. Which of the following is NEITHER an audit role NOR a management role?

A. Evaluating controls.

B. Designing controls.

C. Operating controls.

D. Facilitating a control self‑assessment workshop.

Answer: D – Facilitating a CSA is an assurance‑related role, distinct from both auditing and management.

24. An IS auditor discovers that a colleague has a financial interest in a vendor being audited. Which of the following is the LEAST appropriate action?

A. Report the conflict to audit management.

B. Ignore the conflict because it is personal.

C. Assess whether the colleague should be removed from the engagement.

D. Document the conflict.

Answer: B – Financial interests can impair independence and must be addressed, not ignored.

25. Which of the following is NOT a legitimate reason for an IS auditor to decline an engagement?

A. The auditor lacks the required skills.

B. The auditor has a conflict of interest.

C. The auditor is too busy.

D. The auditor previously designed the controls being audited.

Answer: C – Being “too busy” is not a valid professional reason to decline; lack of competence, conflict of interest, or self‑review threat are valid.

26. An auditor is asked to audit a system that they helped implement. Which of the following is MOST appropriate?

A. Proceed without disclosure because the implementation was years ago.

B. Disclose the prior involvement and let management decide.

C. Proceed because the auditor is the only one with expertise.

D. Decline the engagement or disclose the conflict to audit management.

Answer: D – Prior implementation involvement impairs independence; the auditor should decline or disclose the conflict.

27. Which of the following is ALL of the following EXCEPT a characteristic of an effective audit charter?

A. It states the authority and responsibilities of the audit function.

B. It is approved at the highest level of management.

C. It includes detailed audit procedures.

D. It defines the scope of the audit function.

Answer: C – The audit charter is a high‑level document and does not include detailed procedures.

28. An IS auditor is asked to “help” management by taking responsibility for a control. Which of the following is the LEAST appropriate response?

A. Decline because it would impair independence.

B. Accept because it is only a temporary arrangement.

C. Explain that auditors should not assume operational responsibilities.

D. Escalate the request to audit management.

Answer: B – Accepting operational responsibility impairs independence, even temporarily.

29. Which of the following is NOT a role of an IS auditor in a control self‑assessment (CSA) program?

A. Facilitating workshops.

B. Taking ownership of the controls.

C. Helping process owners define controls.

D. Providing guidance on assessment techniques.

Answer: B – In a CSA, ownership of controls remains with management; the auditor facilitates.

30. An auditor is offered a bonus by the auditee for a “job well done.” Which of the following is MOST appropriate?

A. Accept the bonus because it is a sign of appreciation.

B. Decline the bonus because it may impair independence.

C. Accept the bonus but disclose it in the report.

D. Accept the bonus only if it is small.

Answer: B – Accepting bonuses from the auditee creates a self‑interest threat to independence.

---

Organizational Policies

31. An IS auditor is verifying IT policies and finds that some policies have not been approved by management, yet employees follow them strictly. Which of the following is the MOST appropriate conclusion?

A. The policies are effective because they are followed.

B. The lack of approval is a control weakness.

C. The auditor should ignore the lack of approval.

D. The auditor should recommend that employees stop following the policies.

Answer: B – Policies must be formally approved by management; lack of approval is a governance weakness.

32. Which of the following is NOT a characteristic of a well‑designed organizational policy?

A. It is high‑level and states management intent.

B. It is mandatory.

C. It includes step‑by‑step procedures.

D. It is approved by management.

Answer: C – Step‑by‑step procedures belong in procedures, not policies.

33. An auditor finds that a policy has not been updated for five years. Which of the following is LEAST likely to be a concern?

A. The policy may not reflect current risks.

B. The policy may be inconsistent with current technology.

C. The policy’s font is outdated.

D. The policy may not comply with new regulations.

Answer: C – Font style is irrelevant; outdated content and compliance are the real concerns.

34. Which of the following is ALL of the following EXCEPT a reason why organizational policies are important?

A. They provide management direction.

B. They set mandatory requirements.

C. They replace the need for audits.

D. They support consistent decision‑making.

Answer: C – Policies do not replace audits; audits provide independent assurance.

35. An IS auditor is reviewing a policy that says “all data must be encrypted.” Which of the following is MOST likely missing from this policy?

A. A clear statement of scope and responsibilities.

B. A list of encryption algorithms.

C. Detailed implementation steps.

D. A glossary of terms.

Answer: A – Policies should define scope and responsibilities; detailed algorithms are for standards/procedures.

36. Which of the following is NEITHER a policy NOR a procedure?

A. “All employees must complete security awareness training annually.”

B. “To request access, complete Form A and submit it to the help desk.”

C. “The organization’s risk appetite is low.”

D. “Passwords must be at least 12 characters.”

Answer: C – A statement of risk appetite is a governance statement, not a policy or procedure.

37. An auditor finds that a policy exists but employees are unaware of it. Which of the following is the MOST appropriate recommendation?

A. Delete the policy because it is not used.

B. Improve communication and training on the policy.

C. Ignore the issue because the policy exists.

D. Increase penalties for non‑compliance.

Answer: B – Awareness and training are essential for policy effectiveness.

38. Which of the following is NOT a valid source of organizational policy?

A. Regulatory requirements.

B. Management direction.

C. An auditor’s personal preference.

D. Industry best practices.

Answer: C – Policies should be based on business, legal, and risk considerations, not an auditor’s personal preference.

39. An IS auditor is asked to write a policy for the IT department. Which of the following is the LEAST appropriate action?

A. Decline because policy‑making is a management responsibility.

B. Draft the policy and submit it for management approval.

C. Provide advice on policy content.

D. Explain that the auditor can facilitate but not own the policy.

Answer: B – Auditors should not draft policies; they can provide advice, but ownership belongs to management.

40. Which of the following is ALL of the following EXCEPT a component of a policy framework?

A. Policy.

B. Standard.

C. Procedure.

D. Audit report.

Answer: D – An audit report is an output of an audit, not a component of the policy framework.

41. An auditor finds that a policy conflicts with a regulation. Which of the following is the MOST appropriate action?

A. Ignore the conflict because the policy is internal.

B. Report the conflict to management and recommend alignment.

C. Recommend that the regulation be changed.

D. Document the conflict but take no further action.

Answer: B – Regulatory compliance is mandatory; the auditor should report the conflict.

42. Which of the following is NOT a good practice for policy maintenance?

A. Regular review and update.

B. Version control.

C. Storing policies only on paper.

D. Management approval of changes.

Answer: C – Storing policies only on paper hinders accessibility and version control.

43. An IS auditor is evaluating whether a policy is “effective.” Which of the following is LEAST relevant?

A. The policy is communicated to all staff.

B. The policy is enforced.

C. The policy document is aesthetically pleasing.

D. The policy is reviewed periodically.

Answer: C – Aesthetic appeal is irrelevant; communication, enforcement, and review are key.

44. Which of the following is NEITHER a policy NOR a standard?

A. “Access to production data requires manager approval.”

B. “Passwords must be changed every 90 days.”

C. “The organization will adopt a risk‑based approach to security.”

D. “Firewalls must be configured to deny all traffic by default.”

Answer: C – A statement of approach is a strategic principle, not a specific policy or standard.

45. An auditor finds that a policy has no owner. Which of the following is the MOST appropriate concern?

A. The policy may not be enforced.

B. The policy may be too long.

C. The policy may use complex language.

D. The policy may not be printed.

Answer: A – Lack of ownership often leads to lack of enforcement and maintenance.

---

Auditor Independence

46. An IS auditor’s independence is questioned because they previously worked for the auditee. Which of the following is LEAST appropriate?

A. Disclose the prior relationship.

B. Proceed without any disclosure.

C. Assess whether the prior role impairs objectivity.

D. Consider removing the auditor from the engagement.

Answer: B – Prior employment can impair independence and must be disclosed and assessed.

47. Which of the following is NOT a threat to auditor independence?

A. Self‑review threat.

B. Self‑interest threat.

C. Advocacy threat.

D. Auditor’s competence.

Answer: D – Competence is a required attribute; the other three are threats to independence.

48. An auditor is asked to audit a system they designed. Which of the following is MOST accurate?

A. Independence is impaired due to self‑review.

B. Independence is not impaired if the auditor is competent.

C. Independence is impaired only if the auditor is paid extra.

D. Independence is not a concern for internal auditors.

Answer: A – Designing and then auditing the same system creates a self‑review threat.

49. Which of the following is ALL of the following EXCEPT a way to mitigate threats to independence?

A. Rotating auditors.

B. Independent review of work.

C. Increasing the auditor’s salary.

D. Disclosing conflicts of interest.

Answer: C – Increasing salary does not mitigate independence threats; rotation, review, and disclosure do.

50. An auditor’s spouse is the CFO of the auditee. Which of the following is the LEAST appropriate action?

A. Disclose the relationship.

B. Continue the audit without disclosure.

C. Remove the auditor from the engagement.

D. Assess the threat to independence.

Answer: B – A close family relationship with a senior officer impairs independence and must be disclosed.

51. Which of the following is NEITHER a threat to independence NOR a safeguard?

A. Self‑interest threat.

B. Audit committee oversight.

C. Auditor’s favorite color.

D. Familiarity threat.

Answer: C – Favorite color is irrelevant; the other items are threats or safeguards.

52. An IS auditor is offered a gift by the auditee. Which of the following is MOST appropriate?

A. Accept the gift if it is of low value.

B. Decline the gift and document the offer.

C. Accept the gift and disclose it in the report.

D. Accept the gift because it is customary.

Answer: B – Gifts can create self‑interest threats; declining and documenting is the safest approach.

53. Which of the following is NOT a component of independence?

A. Independence in fact.

B. Independence in appearance.

C. Independence in reporting.

D. Independence in compensation.

Answer: D – Independence in compensation is not a standard component; independence in fact, appearance, and reporting are key.

54. An auditor reports to the IT manager they are auditing. Which of the following is the MOST significant concern?

A. The auditor may not have enough budget.

B. Organizational independence is impaired.

C. The auditor may not have the right software.

D. The auditor may not have a desk.

Answer: B – Reporting to the auditee impairs organizational independence.

55. Which of the following is ALL of the following EXCEPT a safeguard that can protect auditor independence?

A. Reporting to the audit committee.

B. Rotation of audit staff.

C. Auditor participating in operational decisions.

D. Independent quality reviews.

Answer: C – Participating in operational decisions impairs independence; the others are safeguards.

56. An auditor is asked to provide an opinion on a system they helped implement. Which of the following is LEAST appropriate?

A. Disclose the prior involvement.

B. Proceed without disclosure because the implementation was successful.

C. Consider whether a different auditor should perform the review.

D. Document the self‑review threat.

Answer: B – Prior implementation involvement must be disclosed, not hidden.

57. Which of the following is NOT a reason why auditor independence is important?

A. It enhances the credibility of audit findings.

B. It ensures the auditor can make objective judgments.

C. It allows the auditor to design controls.

D. It supports public confidence in the audit function.

Answer: C – Independence does not allow the auditor to design controls; that would impair independence.

58. An auditor’s independence is questioned after they accept a consulting engagement with the auditee. Which of the following is the MOST appropriate response?

A. Ignore the issue because consulting is allowed.

B. Assess the threat and disclose it to audit management.

C. Proceed with the audit without any changes.

D. Cancel the audit immediately.

Answer: B – Consulting can create advocacy or self‑review threats; the threat should be assessed and disclosed.

59. Which of the following is NEITHER an independence threat NOR a safeguard?

A. Intimidation threat.

B. Audit committee oversight.

C. Auditor’s hobby.

D. Self‑review threat.

Answer: C – A hobby is irrelevant; the other items are threats or safeguards.

60. An auditor is asked to audit a process they previously managed. Which of the following is LEAST appropriate?

A. Disclose the prior role.

B. Proceed because enough time has passed.

C. Assess whether independence is impaired.

D. Consider rotating the auditor.

Answer: B – Time alone does not eliminate the self‑review threat; disclosure and assessment are required.

---

Assurance Methods

61. An IS auditor needs evidence about the population of transactions. Which of the following methods is LEAST appropriate for obtaining population coverage?

A. CAATs (full data).

B. Sampling.

C. Inquiry alone.

D. Reperformance.

Answer: C – Inquiry alone provides weak evidence and does not cover the population.

62. Which of the following is NOT a valid assurance method?

A. Observation.

B. Inquiry.

C. Reperformance.

D. Guessing.

Answer: D – Guessing is not an assurance method; the others are valid techniques.

63. An auditor wants to verify that a control is operating effectively. Which of the following methods provides the LEAST direct evidence?

A. Observation.

B. Reperformance.

C. Inquiry.

D. Inspection of documentation.

Answer: C – Inquiry is the least reliable form of evidence.

64. Which of the following is ALL of the following EXCEPT a type of audit evidence?

A. Physical evidence.

B. Testimonial evidence.

C. Documentary evidence.

D. Auditor’s opinion.

Answer: D – The auditor’s opinion is a conclusion, not evidence.

65. An IS auditor needs to test 100% of transactions. Which of the following methods is MOST appropriate?

A. Sampling.

B. CAATs.

C. Inquiry.

D. Observation.

Answer: B – CAATs allow full‑population testing.

66. Which of the following is NOT a characteristic of reliable audit evidence?

A. Sufficiency.

B. Appropriateness.

C. Convenience.

D. Relevance.

Answer: C – Convenience is not a criterion for evidence reliability; sufficiency, appropriateness, and relevance are.

67. An auditor relies solely on management’s oral representations. Which of the following is the MOST significant weakness?

A. Oral evidence is the most reliable.

B. Oral evidence is the least reliable and should be corroborated.

C. Oral evidence is always sufficient.

D. Oral evidence is preferred over documentation.

Answer: B – Oral evidence is weak and must be corroborated.

68. Which of the following is NEITHER a sampling method NOR an evidence‑gathering technique?

A. Discovery sampling.

B. Systematic sampling.

C. Reperformance.

D. Brainstorming.

Answer: D – Brainstorming is not a formal evidence‑gathering technique in auditing.

69. An IS auditor wants to determine whether a fraud has occurred. Which sampling method is MOST appropriate?

A. Attribute sampling.

B. Discovery sampling.

C. Variable sampling.

D. Stop‑or‑go sampling.

Answer: B – Discovery sampling is used to detect the existence of a single occurrence, such as fraud.

70. Which of the following is ALL of the following EXCEPT a factor that affects the sufficiency of evidence?

A. Risk of material misstatement.

B. Quality of evidence.

C. Auditor’s mood.

D. Size of the population.

Answer: C – The auditor’s mood is irrelevant; the other factors influence evidence sufficiency.

71. An auditor uses observation to assess a control. Which of the following is NOT a limitation of observation?

A. The control may be performed differently when not observed.

B. Observation provides direct evidence.

C. Observation is limited to the period observed.

D. Observation cannot reveal whether the control was performed consistently.

Answer: B – Observation does provide direct evidence, but it has limitations; the statement “observation provides direct evidence” is not a limitation.

72. Which of the following is NOT a valid assurance method for verifying the accuracy of a calculation?

A. Reperformance.

B. CAATs.

C. Inquiry.

D. Analytical procedures.

Answer: C – Inquiry alone is not sufficient to verify accuracy.

73. An IS auditor needs evidence about how a process operates in practice. Which of the following is the MOST appropriate method?

A. Inquiry.

B. Observation.

C. Inspection of a policy manual.

D. Review of prior audit reports.

Answer: B – Observation provides direct evidence of process behavior.

74. Which of the following is NEITHER an audit evidence source NOR an assurance method?

A. Confirmation.

B. Analytical procedures.

C. Auditor’s intuition.

D. Recalculation.

Answer: C – Intuition is not a systematic evidence‑gathering method.

75. An auditor is evaluating the reliability of evidence obtained from an independent third party. Which of the following is MOST accurate?

A. Third‑party evidence is generally more reliable than internal evidence.

B. Third‑party evidence is always less reliable.

C. Third‑party evidence is never sufficient.

D. Third‑party evidence is irrelevant.

Answer: A – Evidence from independent external parties is generally more reliable.

76. Which of the following is ALL of the following EXCEPT a characteristic of appropriate audit evidence?

A. Relevance.

B. Reliability.

C. Timeliness.

D. Volume.

Answer: D – Volume alone does not make evidence appropriate; relevance and reliability are key.

77. An auditor uses a checklist to assess compliance. Which of the following is LEAST likely to be a limitation of this method?

A. The checklist may be incomplete.

B. The checklist provides a formal audit opinion.

C. The checklist may not capture nuances.

D. The checklist may be subjective.

Answer: B – A checklist does not provide a formal audit opinion; that is a limitation of the method’s scope, not its nature.

78. Which of the following is NOT an assurance method?

A. Walk‑through.

B. Reperformance.

C. Observation.

D. Speculation.

Answer: D – Speculation is not a systematic assurance method.

79. An IS auditor is selecting an assurance method. Which of the following is LEAST important to consider?

A. The nature of the control being tested.

B. The availability of evidence.

C. The auditor’s personal preference.

D. The level of assurance required.

Answer: C – Personal preference should not drive method selection; it should be based on risk and evidence considerations.

80. Which of the following is NEITHER a sampling risk NOR a non‑sampling risk?

A. Risk that a sample is not representative.

B. Risk that the auditor reaches a wrong conclusion due to factors other than sampling.

C. Risk that the auditor’s coffee is cold.

D. Risk that the auditor fails to recognize a control deviation.

Answer: C – Coffee temperature is irrelevant; the other items are audit risks.

81. An auditor uses inquiry and observation to gather evidence. Which of the following is MOST accurate about these methods?

A. They are the most reliable forms of evidence.

B. They are often used together to corroborate each other.

C. They are sufficient on their own for a formal audit opinion.

D. They are not considered audit evidence.

Answer: B – Inquiry and observation are often combined; neither alone is sufficient for a formal opinion.

82. Which of the following is ALL of the following EXCEPT a valid technique for testing controls?

A. Reperformance.

B. Observation.

C. Inquiry.

D. Ignoring the control.

Answer: D – Ignoring the control is not a testing technique.

83. An auditor needs to verify that a report was generated correctly. Which of the following methods provides the BEST evidence?

A. Inquiry with the report owner.

B. Reperformance of the report logic.

C. Observation of the report being printed.

D. Review of the report’s cover page.

Answer: B – Reperformance provides direct evidence of accuracy.

84. Which of the following is NOT a type of audit sampling?

A. Statistical sampling.

B. Non‑statistical sampling.

C. Judgmental sampling.

D. Random guessing.

Answer: D – Random guessing is not a sampling method.

85. An IS auditor is assessing the effectiveness of a control. Which of the following is LEAST likely to be used as evidence?

A. System logs.

B. Interviews with staff.

C. The auditor’s personal opinion without documentation.

D. Configuration files.

Answer: C – Undocumented personal opinion is not reliable evidence.

86. Which of the following is NEITHER an audit procedure NOR an assurance method?

A. Inspection.

B. Confirmation.

C. Recalculation.

D. Daydreaming.

Answer: D – Daydreaming is not a procedure or method.

87. An auditor uses CAATs to test a full population. Which of the following is MOST accurate?

A. CAATs eliminate the need for professional judgment.

B. CAATs can provide complete population coverage.

C. CAATs are always less reliable than sampling.

D. CAATs are only useful for small populations.

Answer: B – CAATs enable testing of the entire population.

88. Which of the following is ALL of the following EXCEPT a factor that influences the reliability of evidence?

A. Independence of the source.

B. Effectiveness of internal controls.

C. Auditor’s physical attractiveness.

D. Qualifications of the provider.

Answer: C – Physical attractiveness is irrelevant to evidence reliability.

89. An auditor wants to confirm a balance with a third party. Which of the following is the MOST appropriate method?

A. Inquiry.

B. Confirmation.

C. Observation.

D. Reperformance.

Answer: B – Confirmation is the appropriate method for verifying balances with third parties.

90. Which of the following is NOT a limitation of inquiry as an evidence‑gathering method?

A. The respondent may be biased.

B. The respondent may not know the answer.

C. Inquiry provides direct evidence of control operation.

D. Inquiry alone is rarely sufficient.

Answer: C – Inquiry does not provide direct evidence of control operation; it provides testimonial evidence.

91. An auditor is evaluating the sufficiency of evidence. Which of the following is LEAST relevant?

A. The risk of material misstatement.

B. The quality of the evidence.

C. The auditor’s lunch break.

D. The size of the population.

Answer: C – Lunch breaks are irrelevant; risk, quality, and population size matter.

92. Which of the following is NEITHER a test of controls NOR a substantive test?

A. Reperformance of a control.

B. Analytical procedures.

C. Inquiry about a control.

D. Reviewing a policy manual for fun.

Answer: D – Reviewing a manual “for fun” is not a systematic audit test.

93. An IS auditor needs to determine whether a control is designed effectively. Which of the following methods is MOST appropriate?

A. Observation of the control in operation.

B. Inquiry with the control owner.

C. Review of the control design documentation.

D. Reperformance of the control.

Answer: C – Design effectiveness is assessed by reviewing design documentation; operation effectiveness is tested by observation and reperformance.

94. Which of the following is ALL of the following EXCEPT a valid source of audit evidence?

A. External confirmations.

B. Internal documents.

C. Oral representations.

D. The auditor’s dreams.

Answer: D – Dreams are not a source of audit evidence.

95. An auditor uses a walk‑through to understand a process. Which of the following is MOST accurate?

A. A walk‑through is a form of reperformance.

B. A walk‑through typically combines inquiry, observation, and inspection.

C. A walk‑through provides a formal audit opinion.

D. A walk‑through is only used for financial audits.

Answer: B – Walk‑throughs combine multiple techniques to trace a process from start to finish.

96. Which of the following is NOT a characteristic of appropriate evidence?

A. It is relevant to the audit objective.

B. It is reliable.

C. It is sufficient.

D. It is colorful.

Answer: D – Color is irrelevant; relevance, reliability, and sufficiency are the criteria.

97. An auditor is assessing the risk of fraud. Which of the following evidence‑gathering methods is LEAST useful?

A. Data analytics.

B. Discovery sampling.

C. Inquiry alone.

D. Surprise visits.

Answer: C – Inquiry alone is weak for fraud detection; analytics, discovery sampling, and surprise visits are more effective.

98. Which of the following is NEITHER an assurance method NOR an audit technique?

A. Analytical review.

B. Focus groups.

C. Reperformance.

D. Inspection.

Answer: B – Focus groups are not a standard audit technique or assurance method.

99. An IS auditor is evaluating the reliability of evidence from a system‑generated report. Which of the following is MOST important to consider?

A. The report’s font size.

B. Whether the system’s controls are reliable.

C. The color of the report.

D. The number of pages.

Answer: B – System‑generated evidence is only as reliable as the controls over the system.

100. Which of the following is ALL of the following EXCEPT a valid assurance method for obtaining evidence about control effectiveness?

A. Observation.

B. Reperformance.

C. Inquiry.

D. Assuming the control works.

Answer: D – Assuming a control works is not an evidence‑gathering method.