Here are case-based MCQs for CISA Domains 1 and 2, continuing the ISACA "BEST/FIRST/Risk-Based" logic
SECTION A....
Domain 1: Information System Auditing Process (Additional 16 Questions)
Case Study: The Inventory Valuation Audit
An IS auditor is auditing a manufacturing company's inventory system. Management is concerned about obsolete stock, and the external financial auditors are relying on the IS auditor's work for inventory valuation.
Q1. The auditor wants to select a sample of inventory items for price testing. The population is 50,000 SKUs, but 200 items account for 85% of total value. Which sampling approach is MOST appropriate?
A. Simple random sampling of all 50,000 SKUs.
B. Stratified sampling, with the 200 high-value items tested 100% and a statistical sample of the remainder.
C. Discovery sampling focused on the lowest-value items.
D. Judgmental sampling selected by the warehouse manager.
Answer: B
Rationale: Stratified sampling targets high-risk/high-value populations efficiently. Testing 100% of material items and sampling the rest provides defensible coverage while remaining practical .
Q2. The auditor uses CAATs to extract all inventory transactions where the unit cost changed by more than 20% within a 30-day period. What type of audit procedure is this?
A. Substantive testing of account balances.
B. Test of controls over inventory pricing.
C. Analytical procedure to identify anomalous transactions.
D. Compliance testing of the change management process.
Answer: C
Rationale: This is an analytical procedure using CAATs to identify unusual patterns or outliers that warrant further investigation, not a direct test of a specific control .
Q3. The auditor finds that the system allows warehouse supervisors to both adjust inventory quantities and approve their own adjustments. What is the auditor's PRIMARY concern?
A. The supervisors may lack adequate training.
B. There is a segregation of duties conflict enabling concealment of theft.
C. The adjustment reports may be too large to review.
D. The system may not log adjustments in real time.
Answer: B
Rationale: Same-person adjustment and approval is a classic SoD violation. The primary risk is that a supervisor could reduce inventory records to cover physical theft without detection .
Q4. The auditor needs to evaluate whether the inventory valuation report used as evidence is complete. The report was generated by a script written by the IT analyst responsible for the inventory system. What should the auditor do FIRST?
A. Accept the report because IT analysts are technically competent.
B. Independently validate the script logic or re-perform the extraction using auditor-controlled tools.
C. Ask the IT analyst to sign a representation letter.
D. Compare the report total to the general ledger balance.
Answer: B
Rationale: Evidence generated by auditee-controlled scripts lacks independence. The auditor must validate the logic or use independent tools (CAATs) to ensure completeness and accuracy .
---
Case Study: The Audit Charter Dispute
A newly hired IS auditor is asked by the CFO to audit a sensitive payroll system. The IT Director objects, stating that "internal audit reports to the CFO, so auditing payroll creates a conflict." The auditor reviews the audit charter.
Q5. According to IIA/ISACA standards, what is the PRIMARY purpose of the audit charter?
A. To document the audit schedule for the year.
B. To define the audit function's purpose, authority, and responsibility.
C. To list the names of all auditable systems.
D. To establish the auditor's salary grade.
Answer: B
Rationale: The audit charter is the formal document that establishes the internal audit activity's position within the organization, authorizes access to records, and defines scope. It is the foundation for independence .
Q6. The auditor finds that the charter grants "unrestricted access to all records." However, the IT Director has instructed system administrators not to provide payroll data without his approval. What should the auditor do FIRST?
A. Escalate the access restriction to the audit committee.
B. Accept the restriction because payroll is sensitive.
C. Attempt to obtain the data through the CFO.
D. Document the restriction and proceed with the audit without payroll data.
Answer: A
Rationale: Interference with audit access is an independence/scope limitation issue that must be escalated to the highest governing body (audit committee). Attempting workarounds or accepting the limitation undermines the audit function's authority .
Q7. The auditor is planning the engagement and must decide whether to use the work of an external IT security consultant who performed a penetration test. Which factor is MOST important in determining whether to rely on the consultant's work?
A. The consultant's fee for the engagement.
B. The consultant's independence, competence, and objectivity.
C. Whether the consultant used automated tools.
D. The length of the final report.
Answer: B
Rationale: When relying on the work of others, the auditor must evaluate the other party's independence, competence, and objectivity. Cost and report length are irrelevant to reliability .
---
Case Study: The Emergency Change
During an audit of change management, the auditor finds that a critical production patch was applied without a change ticket. The IT manager explains: "It was a zero-day vulnerability. We had to act immediately. The ticket was created retroactively three days later."
Q8. What is the auditor's MOST appropriate conclusion?
A. This is a control failure; all changes must have pre-approval.
B. This is acceptable if a documented emergency change procedure exists with retroactive review.
C. The change should be reversed because it lacked approval.
D. The IT manager should be reprimanded for bypassing controls.
Answer: B
Rationale: Emergency changes are a legitimate exception if a defined fast-path procedure exists that includes retroactive approval and review. The absence of such a procedure would be the finding .
Q9. The auditor wants to test whether emergency changes are properly reviewed after the fact. Which evidence is MOST reliable?
A. A verbal confirmation from the change manager.
B. System-generated change logs showing emergency changes and subsequent approval timestamps.
C. A memo from the IT Director stating that reviews occur.
D. The auditor's observation of a Change Advisory Board meeting.
Answer: B
Rationale: System-generated logs validated against approval records are more reliable than verbal assertions, memos, or one-time observations .
---
Case Study: Sampling and Confidence
An auditor is testing a control that approves purchase orders over $10,000. The population is 5,000 POs. The auditor wants 95% confidence and a 5% tolerable deviation rate.
Q10. The auditor selects a sample and finds 2 deviations in 60 items. What should the auditor conclude?
A. The control is effective because 2 is a small number.
B. The upper deviation limit may exceed the tolerable rate; the control cannot be relied upon as tested.
C. The sample was too large; reduce it and retest.
D. The deviations should be ignored if they were for legitimate business reasons.
Answer: B
Rationale: If the deviation rate in the sample approaches or exceeds the tolerable rate (after considering sampling risk), the auditor cannot conclude the control is effective. Statistical evaluation is required, not impressionistic judgment .
Q11. The auditor decides to use discovery sampling. In which situation is this MOST appropriate?
A. Testing whether purchase orders are approved.
B. Searching for a rare instance of fraud or policy violation.
C. Estimating the total dollar value of inventory.
D. Evaluating the operating effectiveness of a password policy.
Answer: B
Rationale: Discovery sampling is designed to find at least one occurrence of a critical deviation when the expected rate is very low (e.g., fraud). It is not used for estimating rates or monetary values .
---
Case Study: Reporting and Follow-Up
The auditor has finalized a report with a High-risk finding: the disaster recovery plan has never been tested. Management agrees and promises to test within 90 days.
Q12. Six months later, the auditor checks the issue tracking system. The status is still "Open." What should the auditor do NEXT?
A. Close the finding because management acknowledged it.
B. Escalate to the audit committee with the updated status.
C. Re-audit the entire DRP function from scratch.
D. Remove the finding from the historical record to avoid clutter.
Answer: B
Rationale: Post-audit follow-up is a required activity. Unresolved high-risk findings must be escalated to the governing body. The auditor tracks and reports; management owns the remediation .
Q13. The auditor is drafting the finding. Which component describes the "effect"?
A. The control that is missing.
B. The root cause of the deficiency.
C. The risk or impact if the deficiency is not addressed.
D. The recommended corrective action.
Answer: C
Rationale: In the Criteria-Condition-Cause-Effect framework, "Effect" is the risk/impact. "Cause" is the root cause. "Recommendation" is the fix .
---
Case Study: Fraud Indicators
An auditor notices that a payroll clerk has not taken a vacation in three years and consistently refuses to cross-train others. The clerk processes all payroll for a department where a relative is a manager.
Q14. What should the auditor do FIRST?
A. Confront the clerk with the suspicion of fraud.
B. Expand testing of payroll transactions processed by this clerk for anomalies.
C. Report the clerk to law enforcement.
D. Recommend immediate termination.
Answer: B
Rationale: Red flags warrant expanded testing and evidence gathering, not accusation or action. The auditor's role is to determine whether fraud indicators are substantiated by evidence .
Q15. The auditor uses CAATs to identify payroll payments made to employees with no corresponding time records. This is an example of:
A. Testing the general IT controls.
B. A substantive test for existence/occurrence.
C. A test of the change management control.
D. A compliance test of the vacation policy.
Answer: B
Rationale: This test provides evidence about whether recorded payroll transactions actually occurred (existence/occurrence assertion) .
---
Q16. An auditor is asked to audit a system that is being developed and is not yet in production. Which of the following is the MOST significant concern for the auditor?
A. The system may not be documented.
B. Controls may be designed but not yet operating effectively.
C. The project may be over budget.
D. Users may not have been trained.
Answer: B
Rationale: For systems in development, the auditor evaluates design controls and may perform parallel or pilot testing, but cannot conclude on operating effectiveness until the system is live. The risk of relying on untested controls is the primary concern .
---
Domain 2: Governance & Management of IT (Additional 16 Questions)
Case Study: Risk Response Decisions
A hospital's radiology system is running on Windows Server 2008, which no longer receives security patches. The vendor has quoted $200,000 to upgrade to a supported platform. The CISO proposes to "isolate the system behind a firewall and monitor it closely."
Q17. What risk response is the CISO proposing?
A. Avoidance
B. Transfer
C. Mitigation
D. Acceptance
Answer: C
Rationale: The CISO is proposing compensating controls (isolation and monitoring) to reduce the likelihood/impact of exploitation. This is mitigation. If management simply did nothing, it would be acceptance .
Q18. The board decides that the upgrade is too expensive and formally signs off on continuing with the unsupported system. What is this called?
A. Residual risk
B. Inherent risk
C. Risk appetite
D. Risk acceptance
Answer: D
Rationale: Formal acknowledgment and approval of a risk without further action is risk acceptance. The remaining risk after acceptance is the residual risk .
---
Case Study: The RACI Matrix
An organization is implementing a new data warehouse. The project manager presents a RACI chart. The CIO is marked as "Accountable" for data quality. The Data Governance Manager is marked as "Responsible."
Q19. According to RACI principles, what does "Accountable" mean?
A. The person who does the work.
B. The person who must be consulted before decisions.
C. The person who is ultimately answerable for the outcome and has veto authority.
D. The person who should be informed of progress.
Answer: C
Rationale: In RACI, there should be only one "A" (Accountable) per task. This is the person who owns the outcome and has final authority. "R" is the doer .
Q20. The auditor finds that three people are marked "Accountable" for the same deliverable. What is the PRIMARY governance concern?
A. Too many people will be informed.
B. Diffused accountability may lead to no one taking ownership.
C. The project budget may be exceeded.
D. The Responsible party will be overworked.
Answer: B
Rationale: RACI requires a single Accountable person. Multiple A's create ambiguity and dilute ownership, which is a governance weakness .
---
Case Study: COBIT and Performance
The auditor is reviewing IT performance metrics. The CIO reports "99.9% system uptime" and "95% of projects delivered on time" as evidence of IT success.
Q21. Which of the following BEST evaluates whether these metrics demonstrate effective IT governance?
A. The metrics are sufficient if they meet industry benchmarks.
B. The auditor should determine whether these metrics are aligned with business objectives and stakeholder value.
C. The metrics are irrelevant; only financial metrics matter.
D. The auditor should verify the calculation methodology only.
Answer: B
Rationale: Under COBIT, performance measurement must demonstrate value delivery to the business. Technical uptime is meaningless if the business requires 99.99% or if delivered projects don't achieve benefits .
Q22. The auditor finds that IT projects are approved based on the CIO's verbal direction, with no business case. Which COBIT governance objective is MOST directly violated?
A. Ensuring IT is transparent.
B. Ensuring benefits realization and optimizing risk.
C. Ensuring resource optimization.
D. Ensuring stakeholder engagement.
Answer: B
Rationale: The absence of a business case means the organization cannot evaluate whether the investment delivers value (benefits realization) or whether the risk is acceptable. This is a core governance failure under EDM .
---
Case Study: Third-Party Risk
A bank outsources its credit card processing to a third party. The contract states that the provider will "maintain appropriate security controls." The auditor finds no evidence of periodic independent assurance.
Q23. What is the auditor's PRIMARY concern?
A. The provider may charge too much.
B. The bank cannot verify that controls are operating effectively.
C. The contract is too short.
D. The provider may use cloud services.
Answer: B
Rationale: Outsourcing does not transfer accountability. The bank must monitor the provider. Without independent assurance (e.g., SOC reports, audits), the bank has no evidence that controls are effective .
Q24. The auditor recommends adding a "right to audit" clause. What is the BEST reason for this?
A. It allows the bank to avoid paying for assurance.
B. It provides a mechanism to obtain evidence if other assurance is insufficient.
C. It guarantees the provider will have no breaches.
D. It is required by all regulations.
Answer: B
Rationale: A right-to-audit clause gives the organization a fallback mechanism when provider assurances (like SOC reports) are inadequate or the risk is high. It is a governance control, not a guarantee .
---
Case Study: Policies and Standards
An organization has a 50-page "Acceptable Use Policy" that includes detailed technical configuration standards for firewalls and specific password lengths.
Q25. What is the PRIMARY issue with this document?
A. It is too short.
B. It mixes policy (management intent) with standards/procedures (technical specifications).
C. It should be written by the IT department only.
D. It should not mention passwords.
Answer: B
Rationale: Policies state management intent and are approved by senior management. Standards and procedures are the detailed technical implementations. Mixing them creates confusion and makes the policy difficult to maintain and approve .
Q26. The auditor finds that the firewall standard has not been updated in 4 years, but the firewall technology has changed significantly. What should the auditor recommend?
A. Delete the standard.
B. Implement a periodic review and update process for standards and procedures.
C. Outsource firewall management.
D. Move the standard into the policy document.
Answer: B
Rationale: Standards and procedures require regular review to remain relevant. The absence of a review process is the control deficiency .
---
Case Study: Organizational Structure
A company has a CISO who reports to the CIO. The CISO is responsible for enforcing security policies, including restricting the CIO's access to certain sensitive systems.
Q27. What is the MOST significant organizational concern?
A. The CISO may not have enough budget.
B. The CISO lacks independence from the CIO, creating a conflict of interest.
C. The CIO may not understand security.
D. The CISO should report to the CFO instead.
Answer: B
Rationale: If the CISO reports to the CIO, the CISO cannot objectively enforce security controls against the CIO. This is a structural independence issue. The CISO should have a reporting line that provides independence (e.g., to the CEO, board, or CRO) .
Q28. The auditor finds that the database administrators (DBAs) also perform system backups and manage user access. Which SoD principle is violated?
A. Authorization vs. recording.
B. Custody of assets vs. reconciliation.
C. Execution vs. authorization.
D. The DBAs have incompatible access and operational responsibilities.
Answer: D
Rationale: DBAs who manage access can grant themselves privileges; DBAs who perform backups have custody of data. Combining these creates a risk of unauthorized access or data manipulation without detection .
---
Case Study: Legal and Regulatory
A multinational company stores EU customer data in a US data center. The company has not implemented Standard Contractual Clauses or any other transfer mechanism.
Q29. Which regulation is MOST directly implicated?
A. SOX (Sarbanes-Oxley).
B. GDPR (General Data Protection Regulation).
C. HIPAA (Health Insurance Portability and Accountability Act).
D. PCI DSS (Payment Card Industry Data Security Standard).
Answer: B
Rationale: GDPR restricts transfers of EU personal data to countries without adequate protection. The absence of a transfer mechanism is a compliance violation .
Q30. The auditor finds that the company has a privacy policy but no process to handle data subject access requests (DSARs) within the legally required timeframe. What should the auditor recommend FIRST?
A. Stop collecting personal data.
B. Implement a documented DSAR intake, tracking, and response process with defined responsibilities.
C. Hire more lawyers.
D. Ignore it because enforcement is rare.
Answer: B
Rationale: The absence of an operational process to fulfill legal obligations is the deficiency. The recommendation must address the process gap .
---
Q31. An auditor is assessing IT governance maturity. The organization has documented processes, but they are not consistently followed across departments. According to CMMI, what maturity level is this?
A. Level 1 (Initial).
B. Level 2 (Managed).
C. Level 3 (Defined).
D. Level 4 (Quantitatively Managed).
Answer: C
Rationale: Level 3 (Defined) means processes are documented and standardized, but deployment may vary. Level 2 (Managed) is project-level, reactive. Level 4 is metrics-driven .
Q32. The board asks the auditor to evaluate whether IT is "doing the right things." Which of the following BEST addresses this question?
A. Reviewing the IT operational dashboard for uptime.
B. Assessing whether the IT strategy and investment portfolio are aligned with enterprise objectives.
C. Testing the effectiveness of firewall rules.
D. Reviewing the number of help desk tickets resolved.
Answer: B
Rationale: "Doing the right things" is a governance question about strategic alignment and value delivery, not operational efficiency or technical control effectiveness. The auditor must evaluate alignment with business goals .
SECTION B...
Domain 1: Information System Auditing Process (18%)
Case Study 1: The Third-Party CRM Audit
An IS auditor is assigned to audit a new cloud service provider hosting the organization's customer relationship management (CRM) system. The auditor has no prior knowledge of this provider. The provider has supplied a SOC 2 Type II report, but the contract lacks a "right to audit" clause.
Q1. What should be the auditor's FIRST step in planning this engagement?
A. Review the SOC 2 Type II report to identify gaps.
B. Conduct a risk assessment to determine the scope and objectives.
C. Interview the IT manager regarding the provider's performance.
D. Request the service level agreement (SLA) to check penalties.
Answer: B
Rationale: ISACA standards dictate that risk assessment precedes all planning. You must understand the risk profile before you can effectively evaluate evidence like SOC reports or SLAs .
Q2. During fieldwork, the auditor finds that the provider's database administrator (DBA) generated the access logs used as evidence. What is the PRIMARY concern?
A. The logs might be too large to analyze.
B. The DBA could have manipulated the logs, compromising independence.
C. The logs may not be in a readable format.
D. The DBA might charge extra for the extraction.
Answer: B
Rationale: Evidence reliability is compromised when the auditee controls the generation tool. The auditor should ideally use their own extraction tools (CAATs) or validate the script logic independently to ensure completeness and accuracy .
---
Case Study 2: The Disagreement
An auditor discovers a high-risk finding: unencrypted transmission of sensitive payroll data. The IT Manager disagrees, stating that "the firewall protects the internal network." The auditor has the packet capture evidence.
Q3. What should the auditor do NEXT?
A. Remove the finding to maintain a good relationship with management.
B. Escalate immediately to the Audit Committee without discussion.
C. Discuss the finding with the auditee, provide the packet capture evidence, and document the disagreement.
D. Lower the risk rating to "Medium" since the data is internal.
Answer: C
Rationale: Professional standards require the auditor to discuss findings with management and provide supporting evidence before escalating. The auditor must remain objective but also communicative .
---
Domain 2: Governance & Management of IT (18%)
Case Study 3: The Steering Committee Conflict
A retail company has established an IT Steering Committee. The CIO acts as the Chairperson. The committee is responsible for approving the IT strategy and monitoring major project risks. The auditor notes that the CIO also approves project budgets and leads the execution of the strategy.
Q4. Which governance deficiency is MOST material to the auditor's assessment?
A. The absence of a balanced scorecard for IT.
B. Insufficient segregation between oversight (governance) and execution (management).
C. The committee meets only quarterly.
D. The lack of a documented RACI matrix.
Answer: B
Rationale: Under COBIT 2019 principles, governance must be distinct from management. If the CIO chairs the committee that oversees the CIO's own execution, there is a structural conflict of interest (lack of independence). The board/committee cannot objectively evaluate the CIO's performance if the CIO runs the evaluation .
Q5. To remediate this, which of the following is the BEST recommendation?
A. The CIO should step down from the committee, and a board-level director should chair.
B. The CIO should retain the chair but have the CISO co-sign all decisions.
C. The audit committee should take over all IT project execution.
D. The IT Steering Committee should be dissolved and replaced by the Change Advisory Board (CAB).
Answer: A
Rationale: The governance body should be chaired by a business/board representative to ensure independent direction and monitoring. The CAB is operational (change management), not strategic governance .
---
Case Study 4: COBIT & Value Delivery
An organization implemented a new ERP system three years ago. The original business case projected a 3-year payback period through inventory reduction. The auditor finds that no benefits tracking was ever performed, though the system is technically "live" and functioning.
Q6. What is the MOST appropriate audit conclusion?
A. The project failed because the payback wasn't achieved.
B. Value delivery cannot be substantiated; benefits realization controls are inadequate.
C. The project is successful because the system is operational.
D. Only the IT costs need reconciliation; business benefits are the sponsor's issue.
Answer: B
Rationale: Under COBIT (specifically the EDM and APO domains), governance requires monitoring value delivery. The absence of measurement means the organization cannot prove the investment delivered value, which is a governance control weakness—even if the system technically "works" .
---
Q7. During a risk assessment, the auditor finds a legacy server with critical customer data is unpatched and has a high likelihood of exploitation. The cost to patch is $50k, but the potential loss is $2M. Management decides to accept the risk because "the server is behind a firewall." Which risk response is this?
A. Mitigate
B. Transfer
C. Avoid
D. Accept
Answer: D
Rationale: Management has acknowledged the risk and chosen not to act (or insufficiently act). The auditor's role is to evaluate whether this acceptance is within the organization's risk appetite, not to force a fix .
---
Exam Trap Summary (Based on Your Notes)
· FIRST Step: Always Understand Business/Risk (Assessment) before collecting evidence or reviewing reports.
· BEST Answer: Risk-Based Approach trumps budget, schedules, or technical convenience.
· COBIT Logic: Governance (EDM) sets direction; Management (APO/BAI/DSS) executes. Never mix them.
Exam Trap Reminders (Reinforced)
· "FIRST" in audit execution: If evidence is suspect, validate the tool/process before drawing conclusions.
· "BEST" in governance: Independence and alignment with business objectives trump technical fixes.
· Sampling: Statistical > judgmental. Stratified for high-value populations. Discovery for rare events.
· RACI: One Accountable. Multiple = governance failure.
· Risk Response: Mitigation = compensating controls. Acceptance = formal sign-off, not ignoring.
