CISA Domain 1 – Case-Based MCQs with Answers and Explanations Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods Prepared for GMSiSuccess students

 

CISA Domain 1 – Case-Based MCQs with Answers and Explanations Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods Prepared for GMSiSuccess students

CISA Domain 1 – Case-Based MCQs with Answers and Explanations

Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods

Prepared for GMSiSuccess students — these original, exam-style practice questions are designed to develop the application and judgment skills needed for the CISA examination.

section a:

Case Study 1: IT Audit vs. IT Assessment

A financial services company plans to introduce a cloud-based customer management system. Before implementation, management asks an IT risk consultant to evaluate security controls, identify vulnerabilities, and recommend improvements. The consultant issues a report describing the current control environment and areas requiring corrective action.

Question 1

What best distinguishes this engagement from a formal audit?

A. An assessment is always performed without documented procedures.

B. An assessment generally evaluates a situation and identifies gaps, while an audit follows a defined audit process and provides an independent conclusion based on sufficient evidence.

C. An assessment provides higher assurance than an audit because it focuses on risks.

D. An assessment and an audit are identical in purpose, scope, and assurance.

Correct answer: B

Explanation: An assessment commonly identifies risks, weaknesses, and improvement opportunities. An audit is generally more formal, systematic, and evidence-based. The precise scope and level of assurance depend on the engagement; an assessment is not automatically less rigorous.

Question 2

The company's regulator requires independent assurance that its information security controls meet applicable requirements. Which engagement is generally most appropriate?

A. An informal self-assessment by the IT manager.

B. A departmental checklist completed by system administrators.

C. An independent audit performed by suitably qualified and independent auditors.

D. An informal discussion with a cybersecurity consultant.

Correct answer: C

Explanation: Regulatory or licensing requirements may call for independent audit assurance. The organization must confirm the specific regulator's requirements; not every audit automatically qualifies for licensing purposes.

Case Study 2: Auditor, Client, and Auditee

A multinational company appoints an external audit firm to review its ERP access controls. The company's audit committee approves the engagement objectives, while the audit firm performs testing and reports its findings. The IT department provides records and explanations during the audit.

Question 3

Who is primarily responsible for performing the audit procedures?

A. The auditee

B. The auditor

C. The IT department manager

D. The system administrator

Correct answer: B

Explanation: The auditor performs audit procedures, gathers evidence, evaluates controls, and reports findings.

• Auditor: Performs the audit.

• Auditee: The person, department, or organization being audited.

• Client: The party requesting or commissioning the audit.

Question 4

The IT manager asks the audit firm to exclude privileged-user access from the audit scope because several senior executives use those accounts. What should the auditor do FIRST?

A. Accept the request because the IT manager owns the system.

B. Exclude the accounts to avoid conflict with management.

C. Evaluate the implications for the audit objectives and discuss the proposed scope limitation with the appropriate audit authority.

D. Immediately issue an adverse audit opinion without further investigation.

Correct answer: C

Explanation: The auditor should evaluate whether the proposed exclusion compromises the audit's objectives or coverage and escalate the issue appropriately. A scope limitation should not be accepted merely because management requests it.

Question 5

During an IT audit, the auditee provides incomplete access logs. Which action is MOST appropriate?

A. Assume that the missing logs contain no exceptions.

B. Document the limitation, seek alternative evidence, and evaluate its impact on the audit conclusion.

C. Ignore the issue if management provides verbal assurance.

D. Automatically conclude that fraud has occurred.

Correct answer: B

Explanation: Audit conclusions must be supported by sufficient, appropriate evidence. Missing evidence requires further investigation and an evaluation of its effect on the findings and conclusion.

Case Study 3: Organizational IT Policies

A company has experienced repeated data leakage incidents. The IT department drafts an information security policy covering access control, password management, data classification, and incident reporting. The policy is circulated among employees, but no senior executive formally approves it.

Question 6

Who should have ultimate authority for approving and sponsoring the organization's information security policy?

A. The IT helpdesk supervisor

B. The external auditor

C. Senior management or the appropriate governing authority

D. Any employee who understands information security

Correct answer: C

Explanation: Organizational policies should receive authorization from the appropriate senior management or governing authority. IT personnel may draft the policy, but they should not independently establish organizational policy without proper authorization.

Question 7

The internal auditor discovers that the security policy has never been formally approved. What is the GREATEST concern?

A. The policy may contain too many technical terms.

B. Employees may not have a clear, formally authorized direction or accountability for compliance.

C. The policy cannot be stored electronically.

D. The policy must have been written by an external consultant.

Correct answer: B

Explanation: Formal approval establishes management commitment, authority, and accountability. A policy without proper authorization may lack organizational legitimacy and effective enforcement.

Question 8

Management asks the internal auditor to draft the new security policy, approve it, and subsequently audit employee compliance. What is the BEST response?

A. Accept all responsibilities because internal auditors understand controls.

B. Draft and approve the policy, but avoid auditing it.

C. Explain the independence and objectivity risks, and recommend that management own and approve the policy while the auditor retains an appropriate assurance role.

D. Transfer responsibility for the policy to the external auditor.

Correct answer: C

Explanation: Management is responsible for establishing and implementing policies. If an internal auditor assumes management responsibilities, subsequent independent assurance over those responsibilities may be impaired. The auditor can provide advice without taking ownership of management decisions.

Case Study 4: Auditor Independence and Objectivity

A company's internal audit department is reviewing the implementation of a new financial reporting system. The chief financial officer asks the lead auditor to approve the system's access controls before the system goes live. The same auditor is expected to conduct an independent post-implementation audit.

Question 9

What is the PRIMARY concern with the CFO's request?

A. Internal auditors cannot understand financial systems.

B. Approving management's controls could impair the auditor's objectivity when later auditing those controls.

C. Internal auditors must always report directly to the CFO.

D. Only external auditors can review access controls.

Correct answer: B

Explanation: An auditor who takes responsibility for approving or operating controls may later be reviewing their own decisions. This creates a self-review threat to objectivity.

Question 10

Which arrangement BEST supports the independence of the internal audit function?

A. The IT manager determines all audit findings.

B. The CFO can suppress any unfavorable audit report.

C. The internal audit function has appropriate organizational independence, with functional reporting to the audit committee or equivalent governing body.

D. The auditor receives a bonus based on the number of satisfactory findings.

Correct answer: C

Explanation: Appropriate organizational positioning and functional reporting to the audit committee help protect internal audit independence. Independence is supported by governance arrangements, not simply by professional certification.

Question 11

An external audit firm is auditing a company's cybersecurity controls. The lead auditor owns a significant financial interest in the company being audited. What should the firm do?

A. Continue the audit because the auditor works for an external firm.

B. Disclose and evaluate the conflict, and take appropriate action to eliminate or mitigate the independence threat, including replacing the auditor where necessary.

C. Allow the auditor to continue if management agrees.

D. Treat independence as irrelevant because the audit is technical.

Correct answer: B

Explanation: External auditors must maintain independence and avoid conflicts of interest that impair, or appear to impair, their objectivity. Working for an external firm does not automatically guarantee independence.

Case Study 5: Assurance Methods and External Reliance

A software company supplies a payment-processing platform to banks. A licensing authority requires independent evidence that the platform meets specified security and control requirements. The company has already completed an internal self-assessment and received a report from its IT department.

Question 12

Which assurance method is generally the MOST appropriate for satisfying a requirement for independent external assurance?

A. Internal self-assessment

B. Informal management review

C. Independent audit meeting the authority's requirements

D. Verbal confirmation from the IT manager

Correct answer: C

Explanation: Where an external authority requires independent assurance, an appropriately scoped and independent audit is generally suitable. The authority's specific rules determine which report or assurance framework is acceptable.

Question 13

The company's management argues that its internal audit report should automatically satisfy the licensing authority because the internal audit team is qualified. Which response is BEST?

A. All internal audit reports are automatically accepted by licensing authorities.

B. The authority's requirements must be checked because internal audit reports may not meet its independence, scope, or reporting criteria.

C. A qualified internal auditor always provides greater assurance than an external auditor.

D. Internal audits cannot provide any assurance.

Correct answer: B

Explanation: Acceptance depends on the applicable regulatory or licensing requirements, including the required independence, scope, evidence, and reporting format. An internal audit can provide valuable assurance without necessarily meeting every external requirement.

Question 14

A company commissions a consultant to assess its disaster recovery arrangements. The consultant identifies gaps in backup procedures but does not independently test whether the controls operate effectively. Management wants to use the report as proof of compliance.

What is the auditor's or assessor's MOST important consideration?

A. The report's title must contain the word audit.

B. The report should be accepted because the consultant is experienced.

C. The actual scope, procedures, evidence, limitations, and level of assurance must be evaluated before determining whether the report supports the compliance claim.

D. Any written report provides sufficient assurance for external use.

Correct answer: C

Explanation: The label on a report does not determine the assurance it provides. Its scope, testing, evidence, independence, and limitations determine whether it supports the intended purpose.

section b :

6. What is the definition of a standard as compared to a guideline ?
A. Standards are discretionary controls used with guidelines to aid the reader’s decision
process.
B. Standards are mandatory controls designed to support a policy. Following guidelines is
discretionary.
C. Guidelines are recommended controls necessary to support standards, which are
discretionary.
D. Guidelines are intended to designate a policy, whereas standards are used in the
absence of a policy.
7. Which of the following is not defined as a nonaudit role?
A. System designer
B. Operational staff member
C. Auditor
D. Organizational manager
8. Which of the following is the best description of an ongoing audit program for regulatory
compliance?
A. An audit is performed once for the entire year and then repeated by using the same
information for each successive year.
B. An audit may be automated by using audit program software.
C. An audit is a series of unique projects of short duration that add up to cover all the
steps necessary for annual compliance.
D. An audit is a series of assessments performed by the auditee for the purpose of licensing
and regulatory compliance.
9. What is the purpose of ISACA’s professional ethics statement?
A. To clearly specify acceptable and unacceptable behavior
B. To provide procedural advisement to the new IS auditor
C. To provide instructions on how to deal with irregularities and illegal acts by the client
D. To provide advice on when it is acceptable for the auditor to deviate from audit
standards
10. The auditor’s final opinion is to be based on which of the following?
A. The objectives and verbal statements made by management
B. An understanding of management’s desired audit results
C. The audit committee’s specifications
D. The results of evidence and testing
54 Chapter 1 ■ Secrets of a Successful Auditor
11. What are common types of audits?
A. Forensic, accounting, verification, regulatory
B. Integrated, operational, compliance, administrative
C. Financial, SAS‐74, compliance, administrative
D. Information systems, SAS‐70, regulatory, procedural
12. What is the difference between a policy and a procedure?
A. Compliance to a policy is discretionary, and compliance to a procedure is mandatory.
B. A procedure provides discretionary advice to aid in decision making. The policy
defines specific requirements to ensure compliance.
C. A policy is a high‐level document signed by a person of authority, and compliance is
mandatory. A procedure defines the mandatory steps to attain compliance.
D. A policy is a mid‐level document issued to advise the reader of desired actions in the
absence of a standard. The procedure describes suggested steps to use.
13. What is the purpose of standard terms of reference?
A. To meet the legal requirement of regulatory compliance
B. To prove who is responsible
C. To ensure honest and unbiased communication
D. To ensure that requirements are clearly identified in a regulation
14. Which of the following in a business organization will be held liable by the government for
failures of internal controls?
A. President, vice presidents, and other true corporate officers
B. Board of directors, president, vice presidents, department directors, and managers
C. All members of management
D. Board of directors, CEO, CFO, CIO, and department directors
15. Which of the following is true concerning the roles of data owner, data user, and data
custodian?
A. The data user implements controls as necessary.
B. The data custodian is responsible for specifying acceptable usage.
C. The data owner specifies controls.
D. The data custodian specifies security classification.
Review Questions 55
16. What does fiduciary responsibility mean?
A. To use information gained for personal interests without breaching confidentiality of
the client.
B. To act for the benefit of another person and place the responsibilities to be fair and
honest ahead of your own interest.
C. To follow the desires of the client and maintain total confidentiality even if illegal acts
are discovered. The auditor shall never disclose information from an audit in order to
protect the client.
D. None of the above.
17. How does the auditor derive a final opinion?
A. From evidence gathered and the auditor’s observations
B. By representations and assurances of management
C. By testing the compliance of language used in organizational policies
D. Under advice of the audit committee
18. How should the auditor assist in the remediation of problems found during the audit?
A. The auditor should take ownership of the issue and participate in designing the plan
for fixing the problem.
B. The auditor should decide whether the problem is major or minor and then advise the
auditee with a specific solution after considering the impact to the business.
C. The auditor should help the auditees. The auditor can add value by defining the specific
steps necessary for remediation of the problem.
D. The auditor should never take ownership of problems found. Auditors are encouraged
to provide general advice to the auditee, including an explanation of what to look for
during the audit.
19. The type of audit checks attributes against the design specifications.
A. Process
B. System
C. Compliance
D. Product
20. Why is it necessary to protect audit documentation and work papers?
A. The evidence gathered in an audit must be disclosed for regulatory compliance.
B. A paper trail is necessary to prove the auditor is right and the auditee is wrong.
C. The auditor will have to prove illegal activity in a court of law.
D. Audit documentation work papers may reveal confidential information that should not
be lost or disclosed.
56 Chapter 1 ■ Secrets of a Successful Auditor
21. What is the difference between the words should and shall when used in regulations?
A. Shall represents discretionary requirements, and should provides advice to the reader.
B. Should indicates mandatory actions, whereas shall provides advisory information
recommending actions when appropriate.
C. Should and shall are comparable in meaning. The difference is based on the individual
circumstances faced by the audit.
D. Should indicates actions that are discretionary according to need, whereas shall means
the action is mandatory regardless of financial impact.
22. The audit may uncover irregularities and illegal acts that require disclosure. The auditor is
obligated to promptly disclose this information to the authorities.
A. True
B. False
23. Which of the following statements is not true regarding the audit committee?
A. Executives inside the organization oversee the audit committee and are responsible for
keeping the committee busy working on compliance programs.
B. Executives can be hired and fired by the audit committee because this committee is
responsible for management oversight.
C. The audit committee is composed of members from the board of directors. This
committee has the authority to hire external auditors, and external auditors may meet
with the committee on a quarterly basis without other executives present.
D. The audit committee provides senior executives a method of bringing problems into a
confidential discussion for the purpose of exploring a resolution.
24. What term simply means the right people of authority looked at the issue, made an
intelligent decision, and took appropriate action?
A. Leadership
B. Corporate responsibility
C. Chain of command
D. Governance
25. What is the difference between a threat and a vulnerability?
A. Threats are the path that can be exploited by a vulnerability.
B. Threats are risks and become a vulnerability if they occur.
C. Vulnerabilities are a path that can be taken by a threat, resulting in a loss.
D. Vulnerability is a negative event that will cause a loss if it occurs.

answer section b:

6. B. A standard is implemented to ensure a minimum level of uniform compliance.
Guidelines are advisory information used in the absence of a standard. Compliance to
standards is mandatory; compliance to guidelines is discretionary.
7. C. Every role except an auditor is a nonaudit role. Anyone in a nonaudit role is
disqualified from being an independent auditor.
8. C. Projects are unique and usually of limited duration, for a fixed period of time with
a definite start and stop date. The projects may be coupled into a series of projects
to fulfill an ongoing operational need, such as an annual audit program or perpetual
quality program.
9. A. This statement specifies that IS auditors are expected to fulfill their duties with the
highest standards of honest and truthful representation. It is unacceptable to violate
the fiduciary relationship with your client.
10. D. The auditor is to be a professional skeptic who tests assertions of management and
renders an opinion based on the evidence discovered during the audit.
11. B. All of the audit types listed are valid except procedural, SAS‐74, verification,
and regulatory. The valid audit types are financial, operational (SAS‐70), integrated
(SAS‐94), compliance, administrative, forensic, and information systems. A forensic
audit is used to discover information about a possible crime.
Chapter 1: Secrets of a Successful Auditor 573
12. C. A policy is signed by the person of highest authority to ensure compliance by the
members of the organization. Compliance to policies, standards, and procedures is
mandatory.
13. C. Standard terms of reference are used between the auditor and everyone else to ensure
honest and unbiased communication. Without standard terminology, it would be difficult
to know whether we were discussing the same issue or agreed on the same outcome.
14. A. Officers of the organization will typically hold the title of vice president or higher.
A CIO might not be a corporate officer, unless the position is located in the parent
organization. A division‐level CIO may or may not be a true corporate officer. Those
holding the position of department director and below are seldom held liable by the
government for internal control failure. A department director is a supporting manager
to the vice president.
15. C. The data owner specifies controls, is responsible for acceptable use, and appoints
the data custodian. The data users will comply with acceptable use and report
violations. The data custodian will protect information and ensure its availability. The
custodian will also provide support to the users.
16. B. Accountants, auditors, and lawyers act on behalf of their client’s best interests
unless doing so places them in violation of the law. It is the highest standard of duty
implied by law for a trustee and guardian.
17. A. A final opinion is based on evidence gathered and testing. The purpose of an audit
is to challenge the assertions of management. Evidence is gathered that will support or
disprove claims.
18. D. The auditor must never take ownership of the problems found. The auditor may
provide general advice to the auditee and demonstrate what they are looking for during
the audit. The auditee needs to design their own remediation plan. Auditors who
participate in detailed remediation planning are no longer objective nor independent.
19. D. Product audits compare design specifications (feature, size, color, markings, and
so forth) against the attributes of the finished product. The CISA may use this type
of audit during certification of custom‐built software programs or prior to software
release from a development company.
20. D. The auditor may discover information that could cause some level of damage to the
client if disclosed. The information could trigger additional actions by a perpetrator.
In addition, the auditor shall implement controls to ensure security and data backup of
their work.
21. D. Should represents discretionary i d nformation in a regulation. Shall indicates that
compliance is mandatory regardless of profit or loss.
22. B. The auditor should contact one level of management above where the suspected
activity took place. If the problem involved managers responsible for internal controls,
the auditor should report it to the highest level of management available, which is
usually the audit committee. Auditors should never contact the authorities directly
unless advised to do so by their own attorney.
574 Appendix ■ Answers to Review Questions
23. A. All of the answers except A are true. The audit committee is responsible for
management oversight of the executives. The audit committee is usually composed of
board members who provide executives a forum to discuss problems in order to rectify
the situation. The audit committee can hire or fire anyone in the organization, usually
focusing their attention on external auditors and senior executives.
24. D. Governance means the right people of authority made a decision. Governance
occurs at the top level of management to prevent anarchy. Decisions made at too low a
level below the executives may be an indicator of lack of governance.
25. C. Threats are negative events that cause a loss if they occur. Vulnerabilities are paths
that allow a threat to occur.

section c;

*Q1. What is the FIRST step in an IS audit?*

A) Perform risk assessment

B) Understand business objectives and structure

C) Test controls

D) Draft audit report

*Answer: B) Understand business objectives and structure*

_Reason: As per ISACA, auditor must understand business environment before risk assessment._

*Q2. Which audit charter authority is MOST important?*

A) Scope of audit activities

B) Access to records and personnel

C) Reporting line to Audit Committee

D) All of above are equally defined in charter

*Answer: D) All of above are equally defined in charter*

_Reason: IS Audit Charter defines purpose, responsibility, authority including scope, access, reporting._

*Q3. An IS auditor finds material control weakness. What is immediate action?*

A) Ignore if management says will fix

B) Report to auditee first, then include in report

C) Directly report to regulator

D) Stop the audit

*Answer: B) Report to auditee first, then include in report*

_Trap: Don't jump to regulator unless charter requires._

*Q4. Inherent Risk vs Control Risk vs Detection Risk. Formula for Audit Risk?*

A) Audit Risk = Inherent Risk + Control Risk + Detection Risk

B) Audit Risk = Inherent Risk x Control Risk x Detection Risk

C) Audit Risk = Inherent Risk x Control Risk / Detection Risk

D) Audit Risk = Control Risk / Detection Risk

*Answer: B) Audit Risk = Inherent Risk x Control Risk x Detection Risk*

_ISACA definition._

*Q5. Which sampling method provides MOST statistical conclusion?*

A) Judgmental sampling

B) Stratified sampling

C) Haphazard sampling

D) Convenience sampling

*Answer: B) Stratified sampling*

_Reason: Statistical methods – Stratified and Random. Judgmental is non-statistical._

*Q6. Best evidence for operating effectiveness of control?*

A) Inquiry with process owner

B) Observation of control performance

C) Re-performance of control

D) Review of policy document

*Answer: C) Re-performance of control*

_Hierarchy: Re-performance > Observation > Inspection > Inquiry._

*Q7. When should audit evidence be collected?*

A) Only at year-end

B) Throughout audit after planning

C) Only during fieldwork

D) Before planning

*Answer: B) Throughout audit after planning*

*Q8. What is PRIMARY objective of continuous auditing?*

A) Replace annual audit

B) Provide real-time assurance on controls

C) Reduce audit fees to zero

D) Detect fraud only

*Answer: B) Provide real-time assurance on controls*

*Q9. Which is NOT part of audit planning?*

A) Determine audit scope and objectives

B) Assign audit staff

C) Issue final audit report

D) Perform preliminary risk assessment

*Answer: C) Issue final audit report*

_Report is final phase, not planning._

*Q10. Materiality in IS audit is determined by?*

A) Fixed 5% of revenue

B) Auditor's professional judgment based on business impact

C) Management's wish

D) ISACA standard fixed amount

*Answer: B) Auditor's professional judgment based on business impact*

*Q11. What type of audit test checks if controls are correctly designed?*

A) Substantive test

B) Compliance test / Test of controls

C) Walkthrough test of design

D) Analytical test

*Answer: C) Walkthrough test of design – Actually test of design is walkthrough. Compliance test tests operating effectiveness. In exam, design effectiveness = walkthrough, operating = compliance test.*

*Q12. CAATs is MOST useful when?*

A) Small population, manual records

B) Large population, electronic data

C) No data available

D) Audit without system access

*Answer: B) Large population, electronic data*

*Q13. Risk-Based Auditing means?*

A) Audit all areas equally

B) Audit high-risk areas first with more resources

C) Avoid high-risk areas

D) Only audit IT risks

*Answer: B) Audit high-risk areas first with more resources*

*Q14. Independence of IS auditor is impaired when?*

A) Auditor previously worked as developer of same system being audited

B) Auditor has training in auditing

C) Auditor reports to Audit Committee

D) Auditor uses CAATs

*Answer: A) Auditor previously worked as developer of same system being audited*

_Self-review threat._

*Q15. Audit program should be approved by?*

A) Auditee

B) Audit Management / Audit Committee

C) CEO

D) External regulator

*Answer: B) Audit Management / Audit Committee*

*Q16. Which document shows sequence of steps auditor will follow?*

A) Audit Charter

B) Audit Program / Audit Plan

C) Engagement Letter

D) Management Representation Letter

*Answer: B) Audit Program / Audit Plan*

*Q17. Follow-up audit is done to?*

A) Verify corrective actions implemented

B) Start new audit

C) Punish auditee

D) Collect fees

*Answer: A) Verify corrective actions implemented*

*Q18. In risk assessment, which risk cannot be controlled by organization?*

A) Control Risk

B) Inherent Risk

C) Detection Risk

D) Residual Risk

*Answer: B) Inherent Risk*

_Inherent risk is nature of business itself._

*Q19. Generalized Audit Software (GAS) is example of?*

A) Manual audit technique

B) CAATs

C) Physical security control

D) Administrative control

*Answer: B) CAATs*

*Q20. MOST important for reliance on work of internal auditor by external IS auditor?*

A) Internal auditor's objectivity, competence, and work quality

B) Internal auditor's salary

C) Number of staff

D) Location of office

*Answer: A) Objectivity, competence, and work quality*

---

*Bonus Exam Tip for GMSISuccess CIA/CISA Students:*

Domain 1 trap = Confusing Test of Controls vs Substantive Test.

- *Test of Controls (Compliance Test):* Does control work? – Sample small.

- *Substantive Test:* Is data correct? – Sample large, direct verification of transaction.

Compose: New Message

Quick Revision: CISA Domain 1

Concept	Exam-ready takeaway
Assessment vs. audit	Assessments commonly identify gaps; audits follow a systematic, evidence-based process.
Auditor	Performs audit procedures and evaluates evidence.
Auditee	The person, function, or organization being examined.
Client	The party commissioning or requesting the engagement.
Organizational policies	Require authorization from appropriate senior management or governing authority.
Auditor independence	Protects unbiased judgment and credible assurance.
Internal audit	Provides assurance while avoiding inappropriate management responsibilities.
External assurance	Must meet the intended user's or regulator's specific requirements.
Scope limitation	Investigate, document, and evaluate its impact on the audit conclusion.
Evidence	Conclusions must be supported by sufficient, appropriate evidence.

Exam tip for students: In CISA Domain 1, focus on what the auditor should do FIRST, what is MOST appropriate, and which action best protects independence, objectivity, evidence quality, and governance. These questions test judgment, not just definitions.

These are original practice questions based on the concepts in your supplied MCQs, not official ISACA examination questions.

Answers multiple-choice questions covering Budgetary Control, Variance Analysis, Performance Measurement, Responsibility Centers, Divisional Performance (ROI/RI), Segment Reporting, and Goal Congruence, drawn from US CMA Part 1 style and sources.

 

Here is a set of multiple-choice questions covering Budgetary Control, Variance Analysis, Performance Measurement, Responsibility Centers, Divisional Performance (ROI/RI), Segment Reporting, and Goal Congruence, drawn from US CMA Part 1 style and sources.

Section A...

📊 Budgetary Control

1. Which of the following is a key benefit of using a flexible budget rather than a static budget?

A) It simplifies the budgeting process by using fixed inputs.

B) It provides a detailed analysis of variances based on actual activity levels.

C) It ensures that budgeted costs remain constant regardless of changes in activity levels.

D) It eliminates the need for variance analysis.

Correct Answer: B

Explanation: A flexible budget adjusts budgeted costs based on actual activity levels, allowing for a more accurate comparison between budgeted and actual performance.

2. The major objectives of budgeting are to:

A) Foster planning, provide a framework for performance evaluation, and promote communication and coordination.

B) Facilitate the identification of blame for missed budget predictions and ensure goal congruence.

C) Define responsibility centers and ensure goal congruence.

D) Eliminate the need for variance analysis.

Correct Answer: A

Explanation: Budgeting forces a company to establish goals, determine necessary resources, and anticipate future difficulties. It also serves as a control tool by establishing standards and facilitating comparison of actual and budgeted performance.

---

📈 Variance Analysis

**3. A company isolates its raw material price variance in order to provide the earliest possible information to the manager responsible. Budgeted material usage: 150,000 units × 3 lbs/unit × $2.00/lb = $900,000. Actual results: Finished goods produced 160,000 units; raw materials purchased 500,000 lbs; raw materials used 490,000 lbs; cost per pound $2.02. The raw material price variance is:**

A) $9,600 unfavorable

B) $9,800 unfavorable

C) $10,000 unfavorable

D) $20,000 unfavorable

**Correct Answer: C**

*Explanation:* Price variance = (Actual price – Standard price) × Actual quantity = ($2.02 – $2.00) × 500,000 = $10,000 unfavorable.

4. A company's standard cost for direct materials is 3 pounds per unit at $4.00 per pound. During the period, the company produced 5,000 units and used 16,000 pounds of material at a total cost of $62,400. What is the total direct materials variance (price plus quantity)?

A) $2,400 unfavorable

B) $2,400 favorable

C) $3,000 unfavorable

D) $1,600 unfavorable

Correct Answer: A

Explanation: Actual price per pound = $62,400 ÷ 16,000 = $3.90. Standard quantity allowed = 5,000 units × 3 lbs = 15,000 lbs. Price variance = ($3.90 – $4.00) × 16,000 = $1,600 favorable. Quantity variance = (16,000 – 15,000) × $4.00 = $4,000 unfavorable. Total variance = $2,400 unfavorable (or simply actual cost $62,400 – standard cost allowed $60,000 = $2,400 U).

---

🎯 Performance Measurement & Responsibility Centers

5. Which of the following best describes an investment center?

A) A center where managers are responsible only for costs.

B) A responsibility center whose manager is accountable for revenues, costs, and the capital (asset) investment used by the segment.

C) A center where managers are responsible only for revenues.

D) A center that focuses solely on quality control.

Correct Answer: B

Explanation: An investment center manager is accountable for revenues, costs, and the capital investment. Performance is typically evaluated using ROI, residual income, or EVA.

6. All of the following could impair divisional comparison EXCEPT:

A) Age of the divisions’ assets.

B) Business environment of each division.

C) Accounting policies.

D) Remuneration policies.

Correct Answer: D

Explanation: Different accounting policies (depreciation methods, inventory cost flow assumptions, etc.) can affect ROI and RI, impairing comparability. The business environment and asset age also matter. Remuneration policies (how invoices are paid) do not affect divisional performance measures.

---

💰 Divisional Performance: ROI & RI

7. A firm earning a profit can increase its return on investment (ROI) by:

A) Increasing sales revenue and operating expenses by the same dollar amount.

B) Decreasing sales revenues and operating expenses by the same percentage.

C) Increasing investment and operating expenses by the same dollar amount.

D) Increasing sales revenues and operating expenses by the same percentage.

Correct Answer: D

Explanation: If a company is already profitable, increasing sales and expenses by the same percentage will increase operating income and therefore ROI. For example, sales $100, expenses $80, operating income $20, assets $100 → ROI 20%. A 10% increase in both sales and expenses yields operating income $22 → ROI 22%.

8. Which one of the following statements pertaining to ROI as a performance measurement is false?

A) When the average age of assets differs substantially across segments, ROI may not be appropriate.

B) ROI relies on financial measures that are capable of being independently verified, while other forms of performance measures are subject to manipulation.

C) The use of ROI may lead managers to reject capital investment projects that can be justified using discounted cash flow models.

D) The use of ROI can make it undesirable for a skillful manager to take on troubleshooting assignments.

Correct Answer: B

Explanation: ROI is subject to numerous possible manipulations of income and investment amounts. It does not rely on measures that are inherently less manipulable than other performance measures. Answers A, C, and D are true statements about the limitations of ROI.

9. The main argument for the use of residual income (RI) as a measure of performance for investment centres, as opposed to ROI, is that:

A) RI will not cause managers to reject investment alternatives that generate a return greater than the cost of capital, but lower than the division’s average ROI.

B) RI is a more equitable way to compare different size divisions and different aged divisions.

C) Since RI is an absolute amount, rather than a percentage, the problems associated with choosing a denominator (gross book value or net book value etc.) are eliminated.

D) RI is simply easier to calculate than ROI.

Correct Answer: A

Explanation: RI overcomes the goal incongruence problem of ROI, where a manager might reject a profitable project (return > cost of capital) simply because it would lower the division’s average ROI.

---

📑 Segment Reporting & Goal Congruence

10. What is the primary purpose of segment reporting?

A) To hide unprofitable divisions from shareholders.

B) To provide information about different business units (product lines, regions) to assess risk and performance.

C) To reduce the company's tax burden.

D) To calculate EPS.

Correct Answer: B

Explanation: Segment reporting allows financial statement users to better assess the entity's risks and returns by providing detailed information about individual components of the business.

11. A company uses negotiated transfer prices between divisions. All of the following are advantages of this type of transfer pricing model EXCEPT that negotiated transfer prices:

A) Achieve goal congruence.

B) Are simple and quick to implement.

C) Preserve subunit autonomy.

D) Provide performance evaluation information.

Correct Answer: B

Explanation: Negotiated transfer prices are often not simple and quick to implement; they can be time-consuming and may lead to conflicts. The other options are advantages often cited for negotiated transfer pricing.

12. Goal congruence in performance measurement refers to:

A) Ensuring that all divisions have identical performance metrics.

B) Aligning the goals of individual managers and subunits with the overall goals of the organization.

C) Maximizing short-term profits at the expense of long-term value.

D) Reducing the need for a balanced scorecard.

Correct Answer: B

Explanation: Goal congruence occurs when individuals and groups work together toward the organization’s overarching goals. Performance measurement systems should be designed to encourage this alignment.

Section B...

Here is a set of case-based multiple-choice questions covering your requested topics, structured around realistic business scenarios for the US CMA Part 1 exam.

🏢 Case 1: NovaTech Manufacturing – Responsibility Centers & Segment Reporting

NovaTech Manufacturing has three divisions: Components, Assembly, and Services. The Components division manager is evaluated on the controllable margin of her unit. The company allocates a portion of common head office costs to each division based on revenue. The Services division is treated as an investment center, while the Components and Assembly divisions are profit centers.

1. Which of the following costs would be considered a non-controllable cost for the Components division manager?

A) Direct materials used in production

B) Depreciation on a machine the manager decided to purchase last year

C) Allocated share of head office rent

D) Overtime wages approved by the manager

Correct Answer: C

Explanation: Allocated common head office costs are generally not controllable by a division manager, as the allocation is determined by corporate policy. Direct materials, depreciation on assets the manager chose, and overtime the manager approves are typically controllable.

2. When evaluating the segment profit of the Components division, which of the following should be subtracted from the segment contribution margin?

A) Only variable costs

B) Traceable fixed costs but not allocated common costs

C) Allocated common costs but not traceable fixed costs

D) Both traceable fixed costs and allocated common costs

Correct Answer: B

Explanation: Segment profit (segment margin) is calculated as contribution margin minus traceable fixed costs. Allocated common costs are not subtracted because they are not directly attributable to the segment and are often allocated arbitrarily.

3. The Components division manager is evaluated on controllable margin. Which of the following is the most appropriate measure of the manager’s short-term performance?

A) Segment profit

B) Net operating income after common cost allocation

C) Contribution margin minus controllable fixed costs

D) Return on investment (ROI)

Correct Answer: C

Explanation: Controllable margin (or short-run performance margin) is contribution margin less controllable fixed costs. It isolates the revenues and costs the manager can directly influence, making it appropriate for evaluating a profit center manager.

💰 Case 2: Atlas Division – ROI & Residual Income

Atlas Division has net operating income of $400,000 and average operating assets of $2,000,000. The company’s required rate of return (cost of capital) is 12%. The division is considering a new project that requires an investment of $500,000 and is expected to generate additional operating income of $70,000 per year.

4. What is Atlas Division’s current Return on Investment (ROI)?

A) 12%

B) 20%

C) 25%

D) 8%

Correct Answer: B

Explanation: ROI = Net Operating Income ÷ Average Operating Assets = $400,000 ÷ $2,000,000 = 20%.

5. What is Atlas Division’s current Residual Income (RI)?

A) $160,000

B) $240,000

C) $400,000

D) $100,000

Correct Answer: A

Explanation: RI = Net Operating Income – (Average Operating Assets × Required Rate of Return) = $400,000 – ($2,000,000 × 12%) = $400,000 – $240,000 = $160,000.

6. If the manager is evaluated solely on ROI, will she accept the new project?

A) Yes, because the project’s ROI (14%) is above the cost of capital.

B) No, because the project’s ROI (14%) is below the division’s current ROI (20%).

C) Yes, because the project increases absolute operating income.

D) No, because the project’s RI is negative.

Correct Answer: B

Explanation: The project’s ROI is $70,000 ÷ $500,000 = 14%. While this exceeds the 12% cost of capital, it is below the division’s current 20% ROI. A manager evaluated on ROI may reject the project to avoid diluting the division’s average ROI, even though the project is economically beneficial to the company—a classic goal congruence problem.

7. Which performance measure would better align the manager’s interests with those of the company’s owners?

A) ROI, because it is a percentage and easy to compare

B) Residual Income, because it encourages acceptance of any project earning above the cost of capital

C) Segment profit, because it includes all allocated costs

D) Sales growth, because it reflects market expansion

Correct Answer: B

Explanation: RI charges the division for the use of capital at the required rate. The new project earns $70,000 while the capital charge is $60,000 ($500,000 × 12%), resulting in a positive RI of $10,000. RI motivates managers to accept profitable investments that ROI might reject.

---

🔄 Case 3: Vertex Corporation – Centralization vs. Decentralization

Vertex Corporation is considering moving from a centralized structure to a decentralized one, giving division managers more decision-making authority. Top management is concerned about maintaining goal congruence across the organization.

8. Which of the following is a potential disadvantage of decentralization that Vertex should consider?

A) Slower response to local market changes

B) Duplication of costs across divisions

C) Reduced training opportunities for lower-level managers

D) Increased burden on top management for daily decisions

Correct Answer: B

Explanation: Decentralization can lead to duplicated functions (e.g., each division having its own purchasing or HR department), increasing overall costs. Advantages include faster local responses, better training, and freeing top management time.

9. Which of the following best describes goal congruence in the context of Vertex’s performance measurement system?

A) Ensuring all divisions use the same accounting policies

B) Aligning the goals of division managers with the overall goals of the corporation

C) Maximizing the ROI of each division regardless of corporate strategy

D) Centralizing all decision-making at the top level

Correct Answer: B

Explanation: Goal congruence exists when individuals and groups work toward the organization’s overarching goals. Performance measures should be designed so that managers pursuing their own targets also advance corporate objectives.

10. Vertex’s top management wants to reduce the risk of suboptimization. Which of the following actions would best achieve this?

A) Evaluating division managers solely on divisional ROI

B) Using residual income (RI) for investment decisions and performance evaluation

C) Allocating all common costs equally across divisions

D) Centralizing all capital investment decisions at headquarters

Correct Answer: B

Explanation: Suboptimization occurs when segments pursue their own interests at the expense of the whole. RI helps reduce this by encouraging managers to accept projects that earn more than the cost of capital, even if they lower the division’s average ROI.

---

📊 Case 4: Meridian Mills – Operational Excellence & Benchmarking

Meridian Mills is a textile manufacturer striving for operational excellence. The company has set targets to reduce waste, improve machine utilization, and benchmark its performance against competitors.

11. Meridian Mills compares its fuel consumption per ton of fabric with that of a leading logistics company to learn best practices. This is an example of:

A) Internal benchmarking

B) Competitive benchmarking

C) Functional benchmarking

D) Generic benchmarking

Correct Answer: C

Explanation: Functional benchmarking compares processes or functions with organizations outside the direct competitor set, often in other industries, to gain insights and adapt best practices.

12. The company measures efficiency by the ratio of actual output to standard input. Which of the following statements best distinguishes efficiency from effectiveness?

A) Efficiency is about achieving goals; effectiveness is about minimizing resources.

B) Efficiency is about minimizing resources to achieve a given output; effectiveness is about achieving the desired outcome.

C) Efficiency and effectiveness are synonymous in manufacturing.

D) Efficiency relates only to financial measures; effectiveness relates only to non-financial measures.

Correct Answer: B

Explanation: Efficiency means accomplishing a task with the least amount of resources (doing things right). Effectiveness means achieving the desired goal or outcome (doing the right things).

13. Meridian’s manager wants to improve economy in the procurement of raw materials. Which action best reflects an improvement in economy?

A) Reducing the defect rate in production

B) Negotiating lower prices for cotton from suppliers

C) Increasing the selling price of finished fabric

D) Launching a new advertising campaign

Correct Answer: B

Explanation: Economy refers to acquiring resources of the right quality at the lowest possible cost. Negotiating lower raw material prices directly improves economy.

---

⚖️ Case 5: Halcyon Industries – Leverage & Risk

Halcyon Industries has a high degree of financial leverage (significant debt in its capital structure) but a low degree of operating leverage (relatively low fixed operating costs). The company is considering a major investment in automated machinery, which would increase its fixed operating costs.

14. Halcyon’s current strategy of using debt to amplify returns to equity shareholders is known as:

A) Operating leverage

B) Trading on equity

C) Working capital management

D) Capital budgeting

Correct Answer: B

Explanation: Trading on equity refers to using fixed-cost financing (such as debt) to increase the return on equity. It is beneficial when the return on investment exceeds the cost of debt.

15. If Halcyon invests in automated machinery, what will be the likely effect on its operating leverage and financial risk?

A) Operating leverage will decrease; financial risk will increase.

B) Operating leverage will increase; financial risk will remain unchanged if debt is not used.

C) Both operating leverage and financial risk will decrease.

D) Operating leverage will remain unchanged; financial risk will decrease.

Correct Answer: B

Explanation: Investing in automated machinery increases fixed operating costs, which raises operating leverage (business risk). Financial risk is related to capital structure (debt), so if the investment is financed without additional debt, financial risk remains unchanged.

---

📈 Case 6: Pinnacle Retail – Segment Contribution & Customer Analysis

Pinnacle Retail has two product lines: Standard and Premium. The company is preparing a segment contribution report to evaluate the profitability of each line and its customers.

16. In a contribution margin income statement, which of the following is deducted from the segment contribution margin to arrive at segment profit?

A) Variable selling expenses

B) Traceable fixed costs

C) Allocated common head office costs

D) Income tax expense

Correct Answer: B

Explanation: Segment profit (segment margin) = Contribution margin – Traceable fixed costs. Allocated common costs are not subtracted at the segment profit level because they are not directly attributable to the segment.

17. Pinnacle discovers that a major customer, although generating high sales revenue, is unprofitable after accounting for all customer-specific costs. Which analysis tool would best help Pinnacle rank customers from most to least profitable?

A) The balanced scorecard

B) The whale curve

C) A flexible budget

D) Residual income analysis

Correct Answer: B

Explanation: The whale curve organizes customers from most profitable to least profitable and compares that relationship to total profits, helping identify unprofitable customer relationships.

---

💡 Summary of Key Distinctions

Concept Key Takeaway

ROI vs. RI ROI can cause goal incongruence (rejecting profitable projects); RI aligns manager and owner interests.

Segment profit Contribution margin – traceable fixed costs (excludes allocated common costs).

Controllable cost Costs the manager can significantly influence; often not synonymous with variable cost.

Centralization vs. Decentralization Decentralization improves responsiveness but risks duplication and goal incongruence.

Economy, Efficiency, Effectiveness Economy = low-cost resource acquisition; Efficiency = least resources for output; Effectiveness = achieving goals.

Trading on equity Using fixed-cost debt to amplify equity returns when ROI > cost of debt.

Benchmarking types Internal (within firm), Competitive (direct rivals), Functional (other industries/processes), Generic (best-in-class across all industries).

These case-based questions reflect the analytical and decision-making emphasis of the US CMA Part 1 exam. For further practice, focus on computational questions involving ROI/RI with changing asset bases, segment reporting with and without common cost allocations, and identifying goal congruence issues in performance evaluation.

📚 Suggested Study Focus

These questions cover high-yield areas for CMA Part 1. For further practice, focus on:

· Computational variance analysis (price, quantity, mix, yield variances).

· ROI and RI calculations with different asset bases.

· Responsibility center classification and controllable vs. non-controllable costs.

· Segment reporting criteria (10% tests, 75% revenue test).

· Goal congruence issues in transfer pricing and performance evaluation.

case-based multiple-choice questions designed to test the risk management concepts emphasized in the CIA Part 1 exam (Governance, Risk Management, and Control domain)

 case-based multiple-choice questions designed to test the risk management concepts emphasized in the CIA Part 1 exam (Governance, Risk Management, and Control domain)

Case 1: Risk Tolerance vs. Risk Capacity

Scenario: AlfaTech's board has established a risk committee. The committee is evaluating its insurance policies for plant assets. The company is reasonably well-capitalized. During the discussion, the committee makes the following four statements:

· A. "If a fire occurs, the company can withstand a loss of up to $500,000."

· B. "We will review and update the insurance policy annually."

· C. "We will set the insurance deductible at $150,000."

· D. "Under normal circumstances, coverage should be no less than 80% of replacement value."

Question: Which statement best describes the company's risk tolerance ?

Answer:

---

Case 2: Inherent Risk vs. Residual Risk

Scenario: An internal auditor assessed that the risk of steel theft at a plant is high. In response, management introduced three controls: (1) perimeter fencing, (2) a metal detector at the entrance, and (3) monthly steel inventory counts.

Question: If the controls operate as intended, which outcome would the internal auditor hope to see?

· A. Inherent risk will be mitigated to a level lower than residual risk.

· B. Inherent risk will be reduced to an acceptable level.

· C. Residual risk will be reduced to an acceptable level.

· D. Residual risk will be eliminated.

Answer:

---

Case 3: The Three Lines Model – Roles and Independence

Scenario: A mid-sized organization has adopted the Three Lines Model. During a governance review, the following four situations are observed:

· A. Internal audit implemented new controls after identifying deficiencies.

· B. The risk management function reports directly to the chief audit executive (CAE).

· C. Operational management accepts risks and implements controls; internal audit later provides independent assurance over their effectiveness.

· D. Internal audit coordinates and approves risk responses before management implements them.

Question: Which scenario best reflects proper alignment with the Three Lines Model?

Answer:.

---

Case 4: Internal Audit's Role in Risk Management

Scenario: A chief audit executive (CAE) is asked to take on additional responsibilities within the organization's enterprise risk management (ERM) framework. The board asks which of the following roles would be acceptable for the internal audit activity, depending on the organization.

· A. Managing and coordinating the risk management process.

· B. Directing the IT function to implement specific risk controls.

· C. Setting the organization's risk appetite.

· D. Championing risk controls even when they are not cost-effective.

Answer: 

---

Case 5: Relative Risk and Control Failure

Scenario: A purchase order was processed without being compared to an approved price list. An auditor is evaluating the relative risk stemming from this control failure and considers four possible explanations:

· A. A temporary employee processed the purchase order.

· B. The director of the purchasing department approved the purchase order.

· C. The comparison is not required by organizational policy.

· D. The vendor is one used often by the organization.

Question: Which explanation suggests the least amount of relative risk going forward?

Answer:

---

Case 6: Risk Response – Shifting vs. Acceptance

Scenario: A company identifies a high-severity risk related to potential product liability. Management decides to purchase product liability insurance to transfer the financial consequences of a claim. Later, the same company decides not to renew the policy and instead self-insure the exposure, documenting the decision and monitoring the risk.

Question: Which sequence best describes the change in risk response?

· A. Avoidance → Sharing

· B. Sharing → Acceptance

· C. Reduction → Avoidance

· D. Acceptance → Sharing

Answer: 

---

Key Takeaways for CIA Part 1 Risk Management

Concept What to Remember

Risk tolerance Acceptable variation in outcomes; often expressed as a threshold (deductible, limit)

Risk capacity Maximum loss the organization can absorb

Inherent vs. residual Inherent = before controls; residual = after controls. Controls reduce residual risk—they do not change inherent risk

Three Lines Model First line owns risk; second line monitors; third line (internal audit) assures independently—no design/implementation

IA's role in ERM May coordinate and manage the process, but must not make risk decisions or set appetite

Risk responses Avoidance, reduction (mitigation), sharing (transfer), acceptance