CISA Domain 1 – Case-Based MCQs Mocktest Tuesday 27 Oct 2026 Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods

CISA Domain 1 – Case-Based MCQs Mocktest Tuesday 27 Oct 2026 Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods

CISA Domain 1 – Case-Based MCQs Mocktest Tuesday 27 Oct 2026

Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods

Prepared for GMSiSuccess students — these original, exam-style practice questions are designed to develop the application and judgment skills needed for the CISA examination.

section a:

Case Study 1: IT Audit vs. IT Assessment

A financial services company plans to introduce a cloud-based customer management system. Before implementation, management asks an IT risk consultant to evaluate security controls, identify vulnerabilities, and recommend improvements. The consultant issues a report describing the current control environment and areas requiring corrective action.

Question 1

What best distinguishes this engagement from a formal audit?

A. An assessment is always performed without documented procedures.

B. An assessment generally evaluates a situation and identifies gaps, while an audit follows a defined audit process and provides an independent conclusion based on sufficient evidence.

C. An assessment provides higher assurance than an audit because it focuses on risks.

D. An assessment and an audit are identical in purpose, scope, and assurance.

Correct answer:

Question 2

The company's regulator requires independent assurance that its information security controls meet applicable requirements. Which engagement is generally most appropriate?

A. An informal self-assessment by the IT manager.

B. A departmental checklist completed by system administrators.

C. An independent audit performed by suitably qualified and independent auditors.

D. An informal discussion with a cybersecurity consultant.

Correct answer:

Case Study 2: Auditor, Client, and Auditee

A multinational company appoints an external audit firm to review its ERP access controls. The company's audit committee approves the engagement objectives, while the audit firm performs testing and reports its findings. The IT department provides records and explanations during the audit.

Question 3

Who is primarily responsible for performing the audit procedures?

A. The auditee

B. The auditor

C. The IT department manager

D. The system administrator

Correct answer:

Question 4

The IT manager asks the audit firm to exclude privileged-user access from the audit scope because several senior executives use those accounts. What should the auditor do FIRST?

A. Accept the request because the IT manager owns the system.

B. Exclude the accounts to avoid conflict with management.

C. Evaluate the implications for the audit objectives and discuss the proposed scope limitation with the appropriate audit authority.

D. Immediately issue an adverse audit opinion without further investigation.

Correct answer: 

Question 5

During an IT audit, the auditee provides incomplete access logs. Which action is MOST appropriate?

A. Assume that the missing logs contain no exceptions.

B. Document the limitation, seek alternative evidence, and evaluate its impact on the audit conclusion.

C. Ignore the issue if management provides verbal assurance.

D. Automatically conclude that fraud has occurred.

Correct answer:

Case Study 3: Organizational IT Policies

A company has experienced repeated data leakage incidents. The IT department drafts an information security policy covering access control, password management, data classification, and incident reporting. The policy is circulated among employees, but no senior executive formally approves it.

Question 6

Who should have ultimate authority for approving and sponsoring the organization's information security policy?

A. The IT helpdesk supervisor

B. The external auditor

C. Senior management or the appropriate governing authority

D. Any employee who understands information security

Correct answer: 

Question 7

The internal auditor discovers that the security policy has never been formally approved. What is the GREATEST concern?

A. The policy may contain too many technical terms.

B. Employees may not have a clear, formally authorized direction or accountability for compliance.

C. The policy cannot be stored electronically.

D. The policy must have been written by an external consultant.

Correct answer:

Question 8

Management asks the internal auditor to draft the new security policy, approve it, and subsequently audit employee compliance. What is the BEST response?

A. Accept all responsibilities because internal auditors understand controls.

B. Draft and approve the policy, but avoid auditing it.

C. Explain the independence and objectivity risks, and recommend that management own and approve the policy while the auditor retains an appropriate assurance role.

D. Transfer responsibility for the policy to the external auditor.

Correct answer: 

Case Study 4: Auditor Independence and Objectivity

A company's internal audit department is reviewing the implementation of a new financial reporting system. The chief financial officer asks the lead auditor to approve the system's access controls before the system goes live. The same auditor is expected to conduct an independent post-implementation audit.

Question 9

What is the PRIMARY concern with the CFO's request?

A. Internal auditors cannot understand financial systems.

B. Approving management's controls could impair the auditor's objectivity when later auditing those controls.

C. Internal auditors must always report directly to the CFO.

D. Only external auditors can review access controls.

Correct answer: 

Question 10

Which arrangement BEST supports the independence of the internal audit function?

A. The IT manager determines all audit findings.

B. The CFO can suppress any unfavorable audit report.

C. The internal audit function has appropriate organizational independence, with functional reporting to the audit committee or equivalent governing body.

D. The auditor receives a bonus based on the number of satisfactory findings.

Correct answer: 

Question 11

An external audit firm is auditing a company's cybersecurity controls. The lead auditor owns a significant financial interest in the company being audited. What should the firm do?

A. Continue the audit because the auditor works for an external firm.

B. Disclose and evaluate the conflict, and take appropriate action to eliminate or mitigate the independence threat, including replacing the auditor where necessary.

C. Allow the auditor to continue if management agrees.

D. Treat independence as irrelevant because the audit is technical.

Correct answer:

Case Study 5: Assurance Methods and External Reliance

A software company supplies a payment-processing platform to banks. A licensing authority requires independent evidence that the platform meets specified security and control requirements. The company has already completed an internal self-assessment and received a report from its IT department.

Question 12

Which assurance method is generally the MOST appropriate for satisfying a requirement for independent external assurance?

A. Internal self-assessment

B. Informal management review

C. Independent audit meeting the authority's requirements

D. Verbal confirmation from the IT manager

Correct answer

Question 13

The company's management argues that its internal audit report should automatically satisfy the licensing authority because the internal audit team is qualified. Which response is BEST?

A. All internal audit reports are automatically accepted by licensing authorities.

B. The authority's requirements must be checked because internal audit reports may not meet its independence, scope, or reporting criteria.

C. A qualified internal auditor always provides greater assurance than an external auditor.

D. Internal audits cannot provide any assurance.

Correct answer: 

Question 14

A company commissions a consultant to assess its disaster recovery arrangements. The consultant identifies gaps in backup procedures but does not independently test whether the controls operate effectively. Management wants to use the report as proof of compliance.

What is the auditor's or assessor's MOST important consideration?

A. The report's title must contain the word audit.

B. The report should be accepted because the consultant is experienced.

C. The actual scope, procedures, evidence, limitations, and level of assurance must be evaluated before determining whether the report supports the compliance claim.

D. Any written report provides sufficient assurance for external use.

Correct answer:

section b :

6. What is the definition of a standard as compared to a guideline ?
A. Standards are discretionary controls used with guidelines to aid the reader’s decision
process.
B. Standards are mandatory controls designed to support a policy. Following guidelines is
discretionary.
C. Guidelines are recommended controls necessary to support standards, which are
discretionary.
D. Guidelines are intended to designate a policy, whereas standards are used in the
absence of a policy.
7. Which of the following is not defined as a nonaudit role?
A. System designer
B. Operational staff member
C. Auditor
D. Organizational manager
8. Which of the following is the best description of an ongoing audit program for regulatory
compliance?
A. An audit is performed once for the entire year and then repeated by using the same
information for each successive year.
B. An audit may be automated by using audit program software.
C. An audit is a series of unique projects of short duration that add up to cover all the
steps necessary for annual compliance.
D. An audit is a series of assessments performed by the auditee for the purpose of licensing
and regulatory compliance.
9. What is the purpose of ISACA’s professional ethics statement?
A. To clearly specify acceptable and unacceptable behavior
B. To provide procedural advisement to the new IS auditor
C. To provide instructions on how to deal with irregularities and illegal acts by the client
D. To provide advice on when it is acceptable for the auditor to deviate from audit
standards
10. The auditor’s final opinion is to be based on which of the following?
A. The objectives and verbal statements made by management
B. An understanding of management’s desired audit results
C. The audit committee’s specifications
D. The results of evidence and testing

11. What are common types of audits?
A. Forensic, accounting, verification, regulatory
B. Integrated, operational, compliance, administrative
C. Financial, SAS‐74, compliance, administrative
D. Information systems, SAS‐70, regulatory, procedural
12. What is the difference between a policy and a procedure?
A. Compliance to a policy is discretionary, and compliance to a procedure is mandatory.
B. A procedure provides discretionary advice to aid in decision making. The policy
defines specific requirements to ensure compliance.
C. A policy is a high‐level document signed by a person of authority, and compliance is
mandatory. A procedure defines the mandatory steps to attain compliance.
D. A policy is a mid‐level document issued to advise the reader of desired actions in the
absence of a standard. The procedure describes suggested steps to use.
13. What is the purpose of standard terms of reference?
A. To meet the legal requirement of regulatory compliance
B. To prove who is responsible
C. To ensure honest and unbiased communication
D. To ensure that requirements are clearly identified in a regulation
14. Which of the following in a business organization will be held liable by the government for
failures of internal controls?
A. President, vice presidents, and other true corporate officers
B. Board of directors, president, vice presidents, department directors, and managers
C. All members of management
D. Board of directors, CEO, CFO, CIO, and department directors
15. Which of the following is true concerning the roles of data owner, data user, and data
custodian?
A. The data user implements controls as necessary.
B. The data custodian is responsible for specifying acceptable usage.
C. The data owner specifies controls.
D. The data custodian specifies security classification.
Review Questions 55
16. What does fiduciary responsibility mean?
A. To use information gained for personal interests without breaching confidentiality of
the client.
B. To act for the benefit of another person and place the responsibilities to be fair and
honest ahead of your own interest.
C. To follow the desires of the client and maintain total confidentiality even if illegal acts
are discovered. The auditor shall never disclose information from an audit in order to
protect the client.
D. None of the above.
17. How does the auditor derive a final opinion?
A. From evidence gathered and the auditor’s observations
B. By representations and assurances of management
C. By testing the compliance of language used in organizational policies
D. Under advice of the audit committee
18. How should the auditor assist in the remediation of problems found during the audit?
A. The auditor should take ownership of the issue and participate in designing the plan
for fixing the problem.
B. The auditor should decide whether the problem is major or minor and then advise the
auditee with a specific solution after considering the impact to the business.
C. The auditor should help the auditees. The auditor can add value by defining the specific
steps necessary for remediation of the problem.
D. The auditor should never take ownership of problems found. Auditors are encouraged
to provide general advice to the auditee, including an explanation of what to look for
during the audit.
19. The type of audit checks attributes against the design specifications.
A. Process
B. System
C. Compliance
D. Product
20. Why is it necessary to protect audit documentation and work papers?
A. The evidence gathered in an audit must be disclosed for regulatory compliance.
B. A paper trail is necessary to prove the auditor is right and the auditee is wrong.
C. The auditor will have to prove illegal activity in a court of law.
D. Audit documentation work papers may reveal confidential information that should not
be lost or disclosed.

21. What is the difference between the words should and shall when used in regulations?
A. Shall represents discretionary requirements, and should provides advice to the reader.
B. Should indicates mandatory actions, whereas shall provides advisory information
recommending actions when appropriate.
C. Should and shall are comparable in meaning. The difference is based on the individual
circumstances faced by the audit.
D. Should indicates actions that are discretionary according to need, whereas shall means
the action is mandatory regardless of financial impact.
22. The audit may uncover irregularities and illegal acts that require disclosure. The auditor is
obligated to promptly disclose this information to the authorities.
A. True
B. False
23. Which of the following statements is not true regarding the audit committee?
A. Executives inside the organization oversee the audit committee and are responsible for
keeping the committee busy working on compliance programs.
B. Executives can be hired and fired by the audit committee because this committee is
responsible for management oversight.
C. The audit committee is composed of members from the board of directors. This
committee has the authority to hire external auditors, and external auditors may meet
with the committee on a quarterly basis without other executives present.
D. The audit committee provides senior executives a method of bringing problems into a
confidential discussion for the purpose of exploring a resolution.
24. What term simply means the right people of authority looked at the issue, made an
intelligent decision, and took appropriate action?
A. Leadership
B. Corporate responsibility
C. Chain of command
D. Governance
25. What is the difference between a threat and a vulnerability?
A. Threats are the path that can be exploited by a vulnerability.
B. Threats are risks and become a vulnerability if they occur.
C. Vulnerabilities are a path that can be taken by a threat, resulting in a loss.
D. Vulnerability is a negative event that will cause a loss if it occurs.

answer

section c;

*Q1. What is the FIRST step in an IS audit?*

A) Perform risk assessment

B) Understand business objectives and structure

C) Test controls

D) Draft audit report

*Answer:

*Q2. Which audit charter authority is MOST important?*

A) Scope of audit activities

B) Access to records and personnel

C) Reporting line to Audit Committee

D) All of above are equally defined in charter

*Answer:

*Q3. An IS auditor finds material control weakness. What is immediate action?*

A) Ignore if management says will fix

B) Report to auditee first, then include in report

C) Directly report to regulator

D) Stop the audit

*Answer:

*Q4. Inherent Risk vs Control Risk vs Detection Risk. Formula for Audit Risk?*

A) Audit Risk = Inherent Risk + Control Risk + Detection Risk

B) Audit Risk = Inherent Risk x Control Risk x Detection Risk

C) Audit Risk = Inherent Risk x Control Risk / Detection Risk

D) Audit Risk = Control Risk / Detection Risk

*Answer:._

*Q5. Which sampling method provides MOST statistical conclusion?*

A) Judgmental sampling

B) Stratified sampling

C) Haphazard sampling

D) Convenience sampling

*Answer:

*Q6. Best evidence for operating effectiveness of control?*

A) Inquiry with process owner

B) Observation of control performance

C) Re-performance of control

D) Review of policy document

*Answer:

*Q7. When should audit evidence be collected?*

A) Only at year-end

B) Throughout audit after planning

C) Only during fieldwork

D) Before planning

*Answer:

*Q8. What is PRIMARY objective of continuous auditing?*

A) Replace annual audit

B) Provide real-time assurance on controls

C) Reduce audit fees to zero

D) Detect fraud only

*Answer: 

*Q9. Which is NOT part of audit planning?*

A) Determine audit scope and objectives

B) Assign audit staff

C) Issue final audit report

D) Perform preliminary risk assessment

*Answer: 

*Q10. Materiality in IS audit is determined by?*

A) Fixed 5% of revenue

B) Auditor's professional judgment based on business impact

C) Management's wish

D) ISACA standard fixed amount

*Answer

*Q11. What type of audit test checks if controls are correctly designed?*

A) Substantive test

B) Compliance test / Test of controls

C) Walkthrough test of design

D) Analytical test

*Answer: 

*Q12. CAATs is MOST useful when?*

A) Small population, manual records

B) Large population, electronic data

C) No data available

D) Audit without system access

*Answer: 

*Q13. Risk-Based Auditing means?*

A) Audit all areas equally

B) Audit high-risk areas first with more resources

C) Avoid high-risk areas

D) Only audit IT risks

*Answer:

*Q14. Independence of IS auditor is impaired when?*

A) Auditor previously worked as developer of same system being audited

B) Auditor has training in auditing

C) Auditor reports to Audit Committee

D) Auditor uses CAATs

*Answer:

*Q15. Audit program should be approved by?*

A) Auditee

B) Audit Management / Audit Committee

C) CEO

D) External regulator

*Answer:

*Q16. Which document shows sequence of steps auditor will follow?*

A) Audit Charter

B) Audit Program / Audit Plan

C) Engagement Letter

D) Management Representation Letter

*Answer:

*Q17. Follow-up audit is done to?*

A) Verify corrective actions implemented

B) Start new audit

C) Punish auditee

D) Collect fees

*Answer: 

*Q18. In risk assessment, which risk cannot be controlled by organization?*

A) Control Risk

B) Inherent Risk

C) Detection Risk

D) Residual Risk

*Answer: _

*Q19. Generalized Audit Software (GAS) is example of?*

A) Manual audit technique

B) CAATs

C) Physical security control

D) Administrative control

*Answer:

*Q20. MOST important for reliance on work of internal auditor by external IS auditor?*

A) Internal auditor's objectivity, competence, and work quality

B) Internal auditor's salary

C) Number of staff

D) Location of office

*Answer:

Concept	Exam-ready takeaway
Assessment vs. audit	Assessments commonly identify gaps; audits follow a systematic, evidence-based process.
Auditor	Performs audit procedures and evaluates evidence.
Auditee	The person, function, or organization being examined.
Client	The party commissioning or requesting the engagement.
Organizational policies	Require authorization from appropriate senior management or governing authority.
Auditor independence	Protects unbiased judgment and credible assurance.
Internal audit	Provides assurance while avoiding inappropriate management responsibilities.
External assurance	Must meet the intended user's or regulator's specific requirements.
Scope limitation	Investigate, document, and evaluate its impact on the audit conclusion.
Evidence	Conclusions must be supported by sufficient, appropriate evidence.

Exam tip for students: In CISA Domain 1, focus on what the auditor should do FIRST, what is MOST appropriate, and which action best protects independence, objectivity, evidence quality, and governance. These questions test judgment, not just definitions.

www.gmsisuccess.in

*Bonus Exam Tip for GMSISuccess CIA/CISA Students:*

Domain 1 trap = Confusing Test of Controls vs Substantive Test.

- *Test of Controls (Compliance Test):* Does control work? – Sample small.

- *Substantive Test:* Is data correct? – Sample large, direct verification of transaction.

Concept	Exam-ready takeaway
Assessment vs. audit	Assessments commonly identify gaps; audits follow a systematic, evidence-based process.
Auditor	Performs audit procedures and evaluates evidence.
Auditee	The person, function, or organization being examined.
Client	The party commissioning or requesting the engagement.
Organizational policies	Require authorization from appropriate senior management or governing authority.
Auditor independence	Protects unbiased judgment and credible assurance.
Internal audit	Provides assurance while avoiding inappropriate management responsibilities.
External assurance	Must meet the intended user's or regulator's specific requirements.
Scope limitation	Investigate, document, and evaluate its impact on the audit conclusion.
Evidence	Conclusions must be supported by sufficient, appropriate evidence.

Exam tip for students: In CISA Domain 1, focus on what the auditor should do FIRST, what is MOST appropriate, and which action best protects independence, objectivity, evidence quality, and governance. These questions test judgment, not just definitions.

www.gmsisuccess.in