Audit vs. Assessment
1. An IS auditor is asked to review a cloud‑based ERP system. The engagement is described as an “assessment” rather than an “audit.” Which of the following is NOT a characteristic that distinguishes this assessment from a formal audit?
A. The assessment is less formal and focuses on improvement opportunities.
B. The assessment provides independent assurance with a formal opinion.
C. The assessment is typically narrower in scope.
D. The assessment may not be bound by a specific compliance framework.
Answer: B – An assessment does not provide independent assurance with a formal opinion; that is a hallmark of a formal audit.
2. A manager requests a “control review” of a new application. Which of the following is LEAST likely to be a feature of this review compared with a full audit?
A. A formal, evidence‑driven opinion.
B. A focus on identifying weaknesses and risks.
C. A lighter, improvement‑oriented approach.
D. A scope that may be limited to specific controls.
Answer: A – A control review (assessment) is less formal and does not typically deliver a formal audit opinion.
3. During a security assessment, the team uses a checklist to verify compliance with internal standards. Which of the following statements about this activity is FALSE?
A. The activity is an internal evaluation of compliance.
B. The activity provides the same level of assurance as a statutory audit.
C. The activity may identify vulnerabilities and risks.
D. The activity is less formal than an audit.
Answer: B – An assessment does not provide the same high level of assurance as a formal audit.
4. An IS auditor is planning either an audit or an assessment. Which of the following is NOT a factor that should influence the choice between the two?
A. The desired level of assurance.
B. The formality of the final report.
C. The color of the audit team’s laptop bags.
D. The applicable standards or frameworks.
Answer: C – The color of laptop bags is irrelevant; the choice depends on assurance level, formality, scope, and standards.
5. Which of the following is NEITHER an audit NOR an assessment?
A. A compliance review against ISO 27001.
B. A control self‑assessment workshop.
C. A penetration test.
D. A financial statement audit.
Answer: C – A penetration test is a technical security test, not an audit or an assessment in the CISA sense.
6. An organization claims it has conducted an “audit” of its data center. Which of the following would MOST likely indicate that the engagement was actually an assessment?
A. The engagement produced a formal audit opinion.
B. The engagement was evidence‑driven and independent.
C. The engagement focused on improvement opportunities and was less formal.
D. The engagement was performed by external auditors.
Answer: C – Assessments are less formal and improvement‑focused, unlike formal audits.
7. Which of the following is NOT a typical difference between an audit and an assessment?
A. An audit provides independent assurance; an assessment may not.
B. An audit is always performed by external parties; an assessment is always internal.
C. An audit is more formal; an assessment is less formal.
D. An audit is evidence‑driven; an assessment may rely on checklists.
Answer: B – Audits can be internal or external; assessments can also be performed by external parties. The other differences are valid.
8. A CISA candidate is asked to classify a “readiness assessment” conducted before a formal audit. Which of the following is LEAST accurate?
A. It reviews control design to close gaps in advance.
B. It delivers a hard audit opinion.
C. It is lighter than a full audit.
D. It focuses on improvement.
Answer: B – A readiness assessment does not deliver a hard audit opinion; it prepares for an audit.
9. Which of the following statements about assurance is NOT true?
A. Audits provide a high level of assurance.
B. Assessments and reviews typically provide a lower level of assurance.
C. Assurance can only be provided by external auditors.
D. Assurance is a measure of confidence in the conclusions.
Answer: C – Assurance can be provided by internal or external auditors; it is not limited to external parties.
10. An IS auditor is asked to “review” a process. Which of the following is NOT a likely outcome of this review?
A. A formal audit opinion.
B. Recommendations for improvement.
C. Identification of control weaknesses.
D. A report to management.
Answer: A – A review typically does not result in a formal audit opinion.
11. Which of the following is ALL of the following EXCEPT a factor that distinguishes an audit from an assessment?
A. Level of assurance.
B. Degree of formality.
C. Use of evidence.
D. The auditor’s favorite color.
Answer: D – The auditor’s favorite color is irrelevant; the other three are legitimate distinguishing factors.
12. A client asks for a “light‑touch review.” Which of the following is NOT something the IS auditor should assume?
A. The engagement will be less formal.
B. The engagement will focus on improvement.
C. The engagement will automatically produce a formal audit opinion.
D. The engagement may have a narrower scope.
Answer: C – A light‑touch review (assessment) does not automatically produce a formal audit opinion.
13. Which of the following is NEITHER an audit NOR an assessment?
A. A control self‑assessment.
B. A compliance audit.
C. A vulnerability scan.
D. An operational audit.
Answer: C – A vulnerability scan is a technical test, not an audit or assessment.
14. An IS auditor is told that a “gap assessment” was performed. Which of the following is MOST likely NOT a characteristic of that assessment?
A. It compared current state to a desired framework.
B. It produced a formal audit opinion.
C. It identified areas for improvement.
D. It was less formal than a full audit.
Answer: B – A gap assessment does not produce a formal audit opinion; it identifies gaps.
15. Which of the following is NOT a valid reason to choose an assessment over an audit?
A. The organization wants a quick, improvement‑focused review.
B. The organization needs a formal, independent opinion for regulators.
C. The organization wants to prepare for a future audit.
D. The organization wants to raise risk awareness among staff.
Answer: B – If a formal, independent opinion is required, an audit is appropriate, not an assessment.
---
Audit Roles
16. An IS auditor is asked to design and implement a new access control system and then audit it. Which of the following is the MOST appropriate response?
A. Accept, because the auditor has the necessary expertise.
B. Decline, because designing and auditing the same controls violates independence.
C. Accept, but only if the audit is performed by a junior auditor.
D. Decline, because auditors should never provide any advice.
Answer: B – Designing and then auditing the same controls creates a self‑review threat and impairs independence.
17. Which of the following is NOT a typical role of an IS auditor?
A. Evaluating the effectiveness of controls.
B. Designing controls for a new system.
C. Providing assurance on information assets.
D. Reporting findings to management.
Answer: B – Designing controls is a management responsibility; auditors should not design the controls they later audit.
18. An auditor who previously managed the IT department is assigned to audit that same department. Which of the following is LEAST appropriate?
A. The auditor should disclose the prior role.
B. The auditor should proceed without disclosure because the prior role is irrelevant.
C. Audit management should assess whether independence is impaired.
D. The auditor may need to be removed from the engagement.
Answer: B – Prior operational responsibility can impair independence and must be disclosed and assessed.
19. Which of the following is NOT a responsibility of the audit committee?
A. Approving the audit charter.
B. Ensuring the independence of the audit function.
C. Designing and operating internal controls.
D. Overseeing the audit function.
Answer: C – Designing and operating controls is management’s responsibility; the audit committee oversees the audit function.
20. An IS auditor is a member of an application project team but has no operational responsibilities. Which of the following is MOST accurate?
A. Independence is automatically impaired.
B. Independence is not impaired solely by project team membership without operational duties.
C. The auditor must resign from the audit team.
D. The auditor can never audit that application.
Answer: B – Participation as a project team member without operational responsibility does not necessarily impair independence.
21. Which of the following is ALL of the following EXCEPT a way an IS auditor can maintain independence?
A. Avoiding operational responsibilities.
B. Reporting to the audit committee.
C. Accepting gifts from the auditee.
D. Declaring conflicts of interest.
Answer: C – Accepting gifts from the auditee impairs independence; the other actions support independence.
22. An auditor is asked to provide consulting advice on good practices for a new system. Which of the following is NOT true?
A. Providing advice on known good practices does not automatically impair independence.
B. The auditor should avoid making management decisions.
C. The auditor can design the controls and then audit them.
D. The auditor should document the nature of the advice.
Answer: C – Designing controls and then auditing them creates a self‑review threat.
23. Which of the following is NEITHER an audit role NOR a management role?
A. Evaluating controls.
B. Designing controls.
C. Operating controls.
D. Facilitating a control self‑assessment workshop.
Answer: D – Facilitating a CSA is an assurance‑related role, distinct from both auditing and management.
24. An IS auditor discovers that a colleague has a financial interest in a vendor being audited. Which of the following is the LEAST appropriate action?
A. Report the conflict to audit management.
B. Ignore the conflict because it is personal.
C. Assess whether the colleague should be removed from the engagement.
D. Document the conflict.
Answer: B – Financial interests can impair independence and must be addressed, not ignored.
25. Which of the following is NOT a legitimate reason for an IS auditor to decline an engagement?
A. The auditor lacks the required skills.
B. The auditor has a conflict of interest.
C. The auditor is too busy.
D. The auditor previously designed the controls being audited.
Answer: C – Being “too busy” is not a valid professional reason to decline; lack of competence, conflict of interest, or self‑review threat are valid.
26. An auditor is asked to audit a system that they helped implement. Which of the following is MOST appropriate?
A. Proceed without disclosure because the implementation was years ago.
B. Disclose the prior involvement and let management decide.
C. Proceed because the auditor is the only one with expertise.
D. Decline the engagement or disclose the conflict to audit management.
Answer: D – Prior implementation involvement impairs independence; the auditor should decline or disclose the conflict.
27. Which of the following is ALL of the following EXCEPT a characteristic of an effective audit charter?
A. It states the authority and responsibilities of the audit function.
B. It is approved at the highest level of management.
C. It includes detailed audit procedures.
D. It defines the scope of the audit function.
Answer: C – The audit charter is a high‑level document and does not include detailed procedures.
28. An IS auditor is asked to “help” management by taking responsibility for a control. Which of the following is the LEAST appropriate response?
A. Decline because it would impair independence.
B. Accept because it is only a temporary arrangement.
C. Explain that auditors should not assume operational responsibilities.
D. Escalate the request to audit management.
Answer: B – Accepting operational responsibility impairs independence, even temporarily.
29. Which of the following is NOT a role of an IS auditor in a control self‑assessment (CSA) program?
A. Facilitating workshops.
B. Taking ownership of the controls.
C. Helping process owners define controls.
D. Providing guidance on assessment techniques.
Answer: B – In a CSA, ownership of controls remains with management; the auditor facilitates.
30. An auditor is offered a bonus by the auditee for a “job well done.” Which of the following is MOST appropriate?
A. Accept the bonus because it is a sign of appreciation.
B. Decline the bonus because it may impair independence.
C. Accept the bonus but disclose it in the report.
D. Accept the bonus only if it is small.
Answer: B – Accepting bonuses from the auditee creates a self‑interest threat to independence.
---
Organizational Policies
31. An IS auditor is verifying IT policies and finds that some policies have not been approved by management, yet employees follow them strictly. Which of the following is the MOST appropriate conclusion?
A. The policies are effective because they are followed.
B. The lack of approval is a control weakness.
C. The auditor should ignore the lack of approval.
D. The auditor should recommend that employees stop following the policies.
Answer: B – Policies must be formally approved by management; lack of approval is a governance weakness.
32. Which of the following is NOT a characteristic of a well‑designed organizational policy?
A. It is high‑level and states management intent.
B. It is mandatory.
C. It includes step‑by‑step procedures.
D. It is approved by management.
Answer: C – Step‑by‑step procedures belong in procedures, not policies.
33. An auditor finds that a policy has not been updated for five years. Which of the following is LEAST likely to be a concern?
A. The policy may not reflect current risks.
B. The policy may be inconsistent with current technology.
C. The policy’s font is outdated.
D. The policy may not comply with new regulations.
Answer: C – Font style is irrelevant; outdated content and compliance are the real concerns.
34. Which of the following is ALL of the following EXCEPT a reason why organizational policies are important?
A. They provide management direction.
B. They set mandatory requirements.
C. They replace the need for audits.
D. They support consistent decision‑making.
Answer: C – Policies do not replace audits; audits provide independent assurance.
35. An IS auditor is reviewing a policy that says “all data must be encrypted.” Which of the following is MOST likely missing from this policy?
A. A clear statement of scope and responsibilities.
B. A list of encryption algorithms.
C. Detailed implementation steps.
D. A glossary of terms.
Answer: A – Policies should define scope and responsibilities; detailed algorithms are for standards/procedures.
36. Which of the following is NEITHER a policy NOR a procedure?
A. “All employees must complete security awareness training annually.”
B. “To request access, complete Form A and submit it to the help desk.”
C. “The organization’s risk appetite is low.”
D. “Passwords must be at least 12 characters.”
Answer: C – A statement of risk appetite is a governance statement, not a policy or procedure.
37. An auditor finds that a policy exists but employees are unaware of it. Which of the following is the MOST appropriate recommendation?
A. Delete the policy because it is not used.
B. Improve communication and training on the policy.
C. Ignore the issue because the policy exists.
D. Increase penalties for non‑compliance.
Answer: B – Awareness and training are essential for policy effectiveness.
38. Which of the following is NOT a valid source of organizational policy?
A. Regulatory requirements.
B. Management direction.
C. An auditor’s personal preference.
D. Industry best practices.
Answer: C – Policies should be based on business, legal, and risk considerations, not an auditor’s personal preference.
39. An IS auditor is asked to write a policy for the IT department. Which of the following is the LEAST appropriate action?
A. Decline because policy‑making is a management responsibility.
B. Draft the policy and submit it for management approval.
C. Provide advice on policy content.
D. Explain that the auditor can facilitate but not own the policy.
Answer: B – Auditors should not draft policies; they can provide advice, but ownership belongs to management.
40. Which of the following is ALL of the following EXCEPT a component of a policy framework?
A. Policy.
B. Standard.
C. Procedure.
D. Audit report.
Answer: D – An audit report is an output of an audit, not a component of the policy framework.
41. An auditor finds that a policy conflicts with a regulation. Which of the following is the MOST appropriate action?
A. Ignore the conflict because the policy is internal.
B. Report the conflict to management and recommend alignment.
C. Recommend that the regulation be changed.
D. Document the conflict but take no further action.
Answer: B – Regulatory compliance is mandatory; the auditor should report the conflict.
42. Which of the following is NOT a good practice for policy maintenance?
A. Regular review and update.
B. Version control.
C. Storing policies only on paper.
D. Management approval of changes.
Answer: C – Storing policies only on paper hinders accessibility and version control.
43. An IS auditor is evaluating whether a policy is “effective.” Which of the following is LEAST relevant?
A. The policy is communicated to all staff.
B. The policy is enforced.
C. The policy document is aesthetically pleasing.
D. The policy is reviewed periodically.
Answer: C – Aesthetic appeal is irrelevant; communication, enforcement, and review are key.
44. Which of the following is NEITHER a policy NOR a standard?
A. “Access to production data requires manager approval.”
B. “Passwords must be changed every 90 days.”
C. “The organization will adopt a risk‑based approach to security.”
D. “Firewalls must be configured to deny all traffic by default.”
Answer: C – A statement of approach is a strategic principle, not a specific policy or standard.
45. An auditor finds that a policy has no owner. Which of the following is the MOST appropriate concern?
A. The policy may not be enforced.
B. The policy may be too long.
C. The policy may use complex language.
D. The policy may not be printed.
Answer: A – Lack of ownership often leads to lack of enforcement and maintenance.
---
Auditor Independence
46. An IS auditor’s independence is questioned because they previously worked for the auditee. Which of the following is LEAST appropriate?
A. Disclose the prior relationship.
B. Proceed without any disclosure.
C. Assess whether the prior role impairs objectivity.
D. Consider removing the auditor from the engagement.
Answer: B – Prior employment can impair independence and must be disclosed and assessed.
47. Which of the following is NOT a threat to auditor independence?
A. Self‑review threat.
B. Self‑interest threat.
C. Advocacy threat.
D. Auditor’s competence.
Answer: D – Competence is a required attribute; the other three are threats to independence.
48. An auditor is asked to audit a system they designed. Which of the following is MOST accurate?
A. Independence is impaired due to self‑review.
B. Independence is not impaired if the auditor is competent.
C. Independence is impaired only if the auditor is paid extra.
D. Independence is not a concern for internal auditors.
Answer: A – Designing and then auditing the same system creates a self‑review threat.
49. Which of the following is ALL of the following EXCEPT a way to mitigate threats to independence?
A. Rotating auditors.
B. Independent review of work.
C. Increasing the auditor’s salary.
D. Disclosing conflicts of interest.
Answer: C – Increasing salary does not mitigate independence threats; rotation, review, and disclosure do.
50. An auditor’s spouse is the CFO of the auditee. Which of the following is the LEAST appropriate action?
A. Disclose the relationship.
B. Continue the audit without disclosure.
C. Remove the auditor from the engagement.
D. Assess the threat to independence.
Answer: B – A close family relationship with a senior officer impairs independence and must be disclosed.
51. Which of the following is NEITHER a threat to independence NOR a safeguard?
A. Self‑interest threat.
B. Audit committee oversight.
C. Auditor’s favorite color.
D. Familiarity threat.
Answer: C – Favorite color is irrelevant; the other items are threats or safeguards.
52. An IS auditor is offered a gift by the auditee. Which of the following is MOST appropriate?
A. Accept the gift if it is of low value.
B. Decline the gift and document the offer.
C. Accept the gift and disclose it in the report.
D. Accept the gift because it is customary.
Answer: B – Gifts can create self‑interest threats; declining and documenting is the safest approach.
53. Which of the following is NOT a component of independence?
A. Independence in fact.
B. Independence in appearance.
C. Independence in reporting.
D. Independence in compensation.
Answer: D – Independence in compensation is not a standard component; independence in fact, appearance, and reporting are key.
54. An auditor reports to the IT manager they are auditing. Which of the following is the MOST significant concern?
A. The auditor may not have enough budget.
B. Organizational independence is impaired.
C. The auditor may not have the right software.
D. The auditor may not have a desk.
Answer: B – Reporting to the auditee impairs organizational independence.
55. Which of the following is ALL of the following EXCEPT a safeguard that can protect auditor independence?
A. Reporting to the audit committee.
B. Rotation of audit staff.
C. Auditor participating in operational decisions.
D. Independent quality reviews.
Answer: C – Participating in operational decisions impairs independence; the others are safeguards.
56. An auditor is asked to provide an opinion on a system they helped implement. Which of the following is LEAST appropriate?
A. Disclose the prior involvement.
B. Proceed without disclosure because the implementation was successful.
C. Consider whether a different auditor should perform the review.
D. Document the self‑review threat.
Answer: B – Prior implementation involvement must be disclosed, not hidden.
57. Which of the following is NOT a reason why auditor independence is important?
A. It enhances the credibility of audit findings.
B. It ensures the auditor can make objective judgments.
C. It allows the auditor to design controls.
D. It supports public confidence in the audit function.
Answer: C – Independence does not allow the auditor to design controls; that would impair independence.
58. An auditor’s independence is questioned after they accept a consulting engagement with the auditee. Which of the following is the MOST appropriate response?
A. Ignore the issue because consulting is allowed.
B. Assess the threat and disclose it to audit management.
C. Proceed with the audit without any changes.
D. Cancel the audit immediately.
Answer: B – Consulting can create advocacy or self‑review threats; the threat should be assessed and disclosed.
59. Which of the following is NEITHER an independence threat NOR a safeguard?
A. Intimidation threat.
B. Audit committee oversight.
C. Auditor’s hobby.
D. Self‑review threat.
Answer: C – A hobby is irrelevant; the other items are threats or safeguards.
60. An auditor is asked to audit a process they previously managed. Which of the following is LEAST appropriate?
A. Disclose the prior role.
B. Proceed because enough time has passed.
C. Assess whether independence is impaired.
D. Consider rotating the auditor.
Answer: B – Time alone does not eliminate the self‑review threat; disclosure and assessment are required.
---
Assurance Methods
61. An IS auditor needs evidence about the population of transactions. Which of the following methods is LEAST appropriate for obtaining population coverage?
A. CAATs (full data).
B. Sampling.
C. Inquiry alone.
D. Reperformance.
Answer: C – Inquiry alone provides weak evidence and does not cover the population.
62. Which of the following is NOT a valid assurance method?
A. Observation.
B. Inquiry.
C. Reperformance.
D. Guessing.
Answer: D – Guessing is not an assurance method; the others are valid techniques.
63. An auditor wants to verify that a control is operating effectively. Which of the following methods provides the LEAST direct evidence?
A. Observation.
B. Reperformance.
C. Inquiry.
D. Inspection of documentation.
Answer: C – Inquiry is the least reliable form of evidence.
64. Which of the following is ALL of the following EXCEPT a type of audit evidence?
A. Physical evidence.
B. Testimonial evidence.
C. Documentary evidence.
D. Auditor’s opinion.
Answer: D – The auditor’s opinion is a conclusion, not evidence.
65. An IS auditor needs to test 100% of transactions. Which of the following methods is MOST appropriate?
A. Sampling.
B. CAATs.
C. Inquiry.
D. Observation.
Answer: B – CAATs allow full‑population testing.
66. Which of the following is NOT a characteristic of reliable audit evidence?
A. Sufficiency.
B. Appropriateness.
C. Convenience.
D. Relevance.
Answer: C – Convenience is not a criterion for evidence reliability; sufficiency, appropriateness, and relevance are.
67. An auditor relies solely on management’s oral representations. Which of the following is the MOST significant weakness?
A. Oral evidence is the most reliable.
B. Oral evidence is the least reliable and should be corroborated.
C. Oral evidence is always sufficient.
D. Oral evidence is preferred over documentation.
Answer: B – Oral evidence is weak and must be corroborated.
68. Which of the following is NEITHER a sampling method NOR an evidence‑gathering technique?
A. Discovery sampling.
B. Systematic sampling.
C. Reperformance.
D. Brainstorming.
Answer: D – Brainstorming is not a formal evidence‑gathering technique in auditing.
69. An IS auditor wants to determine whether a fraud has occurred. Which sampling method is MOST appropriate?
A. Attribute sampling.
B. Discovery sampling.
C. Variable sampling.
D. Stop‑or‑go sampling.
Answer: B – Discovery sampling is used to detect the existence of a single occurrence, such as fraud.
70. Which of the following is ALL of the following EXCEPT a factor that affects the sufficiency of evidence?
A. Risk of material misstatement.
B. Quality of evidence.
C. Auditor’s mood.
D. Size of the population.
Answer: C – The auditor’s mood is irrelevant; the other factors influence evidence sufficiency.
71. An auditor uses observation to assess a control. Which of the following is NOT a limitation of observation?
A. The control may be performed differently when not observed.
B. Observation provides direct evidence.
C. Observation is limited to the period observed.
D. Observation cannot reveal whether the control was performed consistently.
Answer: B – Observation does provide direct evidence, but it has limitations; the statement “observation provides direct evidence” is not a limitation.
72. Which of the following is NOT a valid assurance method for verifying the accuracy of a calculation?
A. Reperformance.
B. CAATs.
C. Inquiry.
D. Analytical procedures.
Answer: C – Inquiry alone is not sufficient to verify accuracy.
73. An IS auditor needs evidence about how a process operates in practice. Which of the following is the MOST appropriate method?
A. Inquiry.
B. Observation.
C. Inspection of a policy manual.
D. Review of prior audit reports.
Answer: B – Observation provides direct evidence of process behavior.
74. Which of the following is NEITHER an audit evidence source NOR an assurance method?
A. Confirmation.
B. Analytical procedures.
C. Auditor’s intuition.
D. Recalculation.
Answer: C – Intuition is not a systematic evidence‑gathering method.
75. An auditor is evaluating the reliability of evidence obtained from an independent third party. Which of the following is MOST accurate?
A. Third‑party evidence is generally more reliable than internal evidence.
B. Third‑party evidence is always less reliable.
C. Third‑party evidence is never sufficient.
D. Third‑party evidence is irrelevant.
Answer: A – Evidence from independent external parties is generally more reliable.
76. Which of the following is ALL of the following EXCEPT a characteristic of appropriate audit evidence?
A. Relevance.
B. Reliability.
C. Timeliness.
D. Volume.
Answer: D – Volume alone does not make evidence appropriate; relevance and reliability are key.
77. An auditor uses a checklist to assess compliance. Which of the following is LEAST likely to be a limitation of this method?
A. The checklist may be incomplete.
B. The checklist provides a formal audit opinion.
C. The checklist may not capture nuances.
D. The checklist may be subjective.
Answer: B – A checklist does not provide a formal audit opinion; that is a limitation of the method’s scope, not its nature.
78. Which of the following is NOT an assurance method?
A. Walk‑through.
B. Reperformance.
C. Observation.
D. Speculation.
Answer: D – Speculation is not a systematic assurance method.
79. An IS auditor is selecting an assurance method. Which of the following is LEAST important to consider?
A. The nature of the control being tested.
B. The availability of evidence.
C. The auditor’s personal preference.
D. The level of assurance required.
Answer: C – Personal preference should not drive method selection; it should be based on risk and evidence considerations.
80. Which of the following is NEITHER a sampling risk NOR a non‑sampling risk?
A. Risk that a sample is not representative.
B. Risk that the auditor reaches a wrong conclusion due to factors other than sampling.
C. Risk that the auditor’s coffee is cold.
D. Risk that the auditor fails to recognize a control deviation.
Answer: C – Coffee temperature is irrelevant; the other items are audit risks.
81. An auditor uses inquiry and observation to gather evidence. Which of the following is MOST accurate about these methods?
A. They are the most reliable forms of evidence.
B. They are often used together to corroborate each other.
C. They are sufficient on their own for a formal audit opinion.
D. They are not considered audit evidence.
Answer: B – Inquiry and observation are often combined; neither alone is sufficient for a formal opinion.
82. Which of the following is ALL of the following EXCEPT a valid technique for testing controls?
A. Reperformance.
B. Observation.
C. Inquiry.
D. Ignoring the control.
Answer: D – Ignoring the control is not a testing technique.
83. An auditor needs to verify that a report was generated correctly. Which of the following methods provides the BEST evidence?
A. Inquiry with the report owner.
B. Reperformance of the report logic.
C. Observation of the report being printed.
D. Review of the report’s cover page.
Answer: B – Reperformance provides direct evidence of accuracy.
84. Which of the following is NOT a type of audit sampling?
A. Statistical sampling.
B. Non‑statistical sampling.
C. Judgmental sampling.
D. Random guessing.
Answer: D – Random guessing is not a sampling method.
85. An IS auditor is assessing the effectiveness of a control. Which of the following is LEAST likely to be used as evidence?
A. System logs.
B. Interviews with staff.
C. The auditor’s personal opinion without documentation.
D. Configuration files.
Answer: C – Undocumented personal opinion is not reliable evidence.
86. Which of the following is NEITHER an audit procedure NOR an assurance method?
A. Inspection.
B. Confirmation.
C. Recalculation.
D. Daydreaming.
Answer: D – Daydreaming is not a procedure or method.
87. An auditor uses CAATs to test a full population. Which of the following is MOST accurate?
A. CAATs eliminate the need for professional judgment.
B. CAATs can provide complete population coverage.
C. CAATs are always less reliable than sampling.
D. CAATs are only useful for small populations.
Answer: B – CAATs enable testing of the entire population.
88. Which of the following is ALL of the following EXCEPT a factor that influences the reliability of evidence?
A. Independence of the source.
B. Effectiveness of internal controls.
C. Auditor’s physical attractiveness.
D. Qualifications of the provider.
Answer: C – Physical attractiveness is irrelevant to evidence reliability.
89. An auditor wants to confirm a balance with a third party. Which of the following is the MOST appropriate method?
A. Inquiry.
B. Confirmation.
C. Observation.
D. Reperformance.
Answer: B – Confirmation is the appropriate method for verifying balances with third parties.
90. Which of the following is NOT a limitation of inquiry as an evidence‑gathering method?
A. The respondent may be biased.
B. The respondent may not know the answer.
C. Inquiry provides direct evidence of control operation.
D. Inquiry alone is rarely sufficient.
Answer: C – Inquiry does not provide direct evidence of control operation; it provides testimonial evidence.
91. An auditor is evaluating the sufficiency of evidence. Which of the following is LEAST relevant?
A. The risk of material misstatement.
B. The quality of the evidence.
C. The auditor’s lunch break.
D. The size of the population.
Answer: C – Lunch breaks are irrelevant; risk, quality, and population size matter.
92. Which of the following is NEITHER a test of controls NOR a substantive test?
A. Reperformance of a control.
B. Analytical procedures.
C. Inquiry about a control.
D. Reviewing a policy manual for fun.
Answer: D – Reviewing a manual “for fun” is not a systematic audit test.
93. An IS auditor needs to determine whether a control is designed effectively. Which of the following methods is MOST appropriate?
A. Observation of the control in operation.
B. Inquiry with the control owner.
C. Review of the control design documentation.
D. Reperformance of the control.
Answer: C – Design effectiveness is assessed by reviewing design documentation; operation effectiveness is tested by observation and reperformance.
94. Which of the following is ALL of the following EXCEPT a valid source of audit evidence?
A. External confirmations.
B. Internal documents.
C. Oral representations.
D. The auditor’s dreams.
Answer: D – Dreams are not a source of audit evidence.
95. An auditor uses a walk‑through to understand a process. Which of the following is MOST accurate?
A. A walk‑through is a form of reperformance.
B. A walk‑through typically combines inquiry, observation, and inspection.
C. A walk‑through provides a formal audit opinion.
D. A walk‑through is only used for financial audits.
Answer: B – Walk‑throughs combine multiple techniques to trace a process from start to finish.
96. Which of the following is NOT a characteristic of appropriate evidence?
A. It is relevant to the audit objective.
B. It is reliable.
C. It is sufficient.
D. It is colorful.
Answer: D – Color is irrelevant; relevance, reliability, and sufficiency are the criteria.
97. An auditor is assessing the risk of fraud. Which of the following evidence‑gathering methods is LEAST useful?
A. Data analytics.
B. Discovery sampling.
C. Inquiry alone.
D. Surprise visits.
Answer: C – Inquiry alone is weak for fraud detection; analytics, discovery sampling, and surprise visits are more effective.
98. Which of the following is NEITHER an assurance method NOR an audit technique?
A. Analytical review.
B. Focus groups.
C. Reperformance.
D. Inspection.
Answer: B – Focus groups are not a standard audit technique or assurance method.
99. An IS auditor is evaluating the reliability of evidence from a system‑generated report. Which of the following is MOST important to consider?
A. The report’s font size.
B. Whether the system’s controls are reliable.
C. The color of the report.
D. The number of pages.
Answer: B – System‑generated evidence is only as reliable as the controls over the system.
100. Which of the following is ALL of the following EXCEPT a valid assurance method for obtaining evidence about control effectiveness?
A. Observation.
B. Reperformance.
C. Inquiry.
D. Assuming the control works.
Answer: D – Assuming a control works is not an evidence‑gathering method.
