CISA Domain 1 – Case-Based MCQs with Answers and Explanations
Topic: Audit vs. Assessment, Audit Roles, Organizational Policies, Auditor Independence, and Assurance Methods
Prepared for GMSiSuccess students — these original, exam-style practice questions are designed to develop the application and judgment skills needed for the CISA examination.
section a:
Case Study 1: IT Audit vs. IT Assessment
A financial services company plans to introduce a cloud-based customer management system. Before implementation, management asks an IT risk consultant to evaluate security controls, identify vulnerabilities, and recommend improvements. The consultant issues a report describing the current control environment and areas requiring corrective action.
Question 1
What best distinguishes this engagement from a formal audit?
A. An assessment is always performed without documented procedures.
B. An assessment generally evaluates a situation and identifies gaps, while an audit follows a defined audit process and provides an independent conclusion based on sufficient evidence.
C. An assessment provides higher assurance than an audit because it focuses on risks.
D. An assessment and an audit are identical in purpose, scope, and assurance.
Correct answer: B
Explanation: An assessment commonly identifies risks, weaknesses, and improvement opportunities. An audit is generally more formal, systematic, and evidence-based. The precise scope and level of assurance depend on the engagement; an assessment is not automatically less rigorous.
Question 2
The company's regulator requires independent assurance that its information security controls meet applicable requirements. Which engagement is generally most appropriate?
A. An informal self-assessment by the IT manager.
B. A departmental checklist completed by system administrators.
C. An independent audit performed by suitably qualified and independent auditors.
D. An informal discussion with a cybersecurity consultant.
Correct answer: C
Explanation: Regulatory or licensing requirements may call for independent audit assurance. The organization must confirm the specific regulator's requirements; not every audit automatically qualifies for licensing purposes.
Case Study 2: Auditor, Client, and Auditee
A multinational company appoints an external audit firm to review its ERP access controls. The company's audit committee approves the engagement objectives, while the audit firm performs testing and reports its findings. The IT department provides records and explanations during the audit.
Question 3
Who is primarily responsible for performing the audit procedures?
A. The auditee
B. The auditor
C. The IT department manager
D. The system administrator
Correct answer: B
Explanation: The auditor performs audit procedures, gathers evidence, evaluates controls, and reports findings.
Auditor: Performs the audit.
Auditee: The person, department, or organization being audited.
Client: The party requesting or commissioning the audit.
Question 4
The IT manager asks the audit firm to exclude privileged-user access from the audit scope because several senior executives use those accounts. What should the auditor do FIRST?
A. Accept the request because the IT manager owns the system.
B. Exclude the accounts to avoid conflict with management.
C. Evaluate the implications for the audit objectives and discuss the proposed scope limitation with the appropriate audit authority.
D. Immediately issue an adverse audit opinion without further investigation.
Correct answer: C
Explanation: The auditor should evaluate whether the proposed exclusion compromises the audit's objectives or coverage and escalate the issue appropriately. A scope limitation should not be accepted merely because management requests it.
Question 5
During an IT audit, the auditee provides incomplete access logs. Which action is MOST appropriate?
A. Assume that the missing logs contain no exceptions.
B. Document the limitation, seek alternative evidence, and evaluate its impact on the audit conclusion.
C. Ignore the issue if management provides verbal assurance.
D. Automatically conclude that fraud has occurred.
Correct answer: B
Explanation: Audit conclusions must be supported by sufficient, appropriate evidence. Missing evidence requires further investigation and an evaluation of its effect on the findings and conclusion.
Case Study 3: Organizational IT Policies
A company has experienced repeated data leakage incidents. The IT department drafts an information security policy covering access control, password management, data classification, and incident reporting. The policy is circulated among employees, but no senior executive formally approves it.
Question 6
Who should have ultimate authority for approving and sponsoring the organization's information security policy?
A. The IT helpdesk supervisor
B. The external auditor
C. Senior management or the appropriate governing authority
D. Any employee who understands information security
Correct answer: C
Explanation: Organizational policies should receive authorization from the appropriate senior management or governing authority. IT personnel may draft the policy, but they should not independently establish organizational policy without proper authorization.
Question 7
The internal auditor discovers that the security policy has never been formally approved. What is the GREATEST concern?
A. The policy may contain too many technical terms.
B. Employees may not have a clear, formally authorized direction or accountability for compliance.
C. The policy cannot be stored electronically.
D. The policy must have been written by an external consultant.
Correct answer: B
Explanation: Formal approval establishes management commitment, authority, and accountability. A policy without proper authorization may lack organizational legitimacy and effective enforcement.
Question 8
Management asks the internal auditor to draft the new security policy, approve it, and subsequently audit employee compliance. What is the BEST response?
A. Accept all responsibilities because internal auditors understand controls.
B. Draft and approve the policy, but avoid auditing it.
C. Explain the independence and objectivity risks, and recommend that management own and approve the policy while the auditor retains an appropriate assurance role.
D. Transfer responsibility for the policy to the external auditor.
Correct answer: C
Explanation: Management is responsible for establishing and implementing policies. If an internal auditor assumes management responsibilities, subsequent independent assurance over those responsibilities may be impaired. The auditor can provide advice without taking ownership of management decisions.
Case Study 4: Auditor Independence and Objectivity
A company's internal audit department is reviewing the implementation of a new financial reporting system. The chief financial officer asks the lead auditor to approve the system's access controls before the system goes live. The same auditor is expected to conduct an independent post-implementation audit.
Question 9
What is the PRIMARY concern with the CFO's request?
A. Internal auditors cannot understand financial systems.
B. Approving management's controls could impair the auditor's objectivity when later auditing those controls.
C. Internal auditors must always report directly to the CFO.
D. Only external auditors can review access controls.
Correct answer: B
Explanation: An auditor who takes responsibility for approving or operating controls may later be reviewing their own decisions. This creates a self-review threat to objectivity.
Question 10
Which arrangement BEST supports the independence of the internal audit function?
A. The IT manager determines all audit findings.
B. The CFO can suppress any unfavorable audit report.
C. The internal audit function has appropriate organizational independence, with functional reporting to the audit committee or equivalent governing body.
D. The auditor receives a bonus based on the number of satisfactory findings.
Correct answer: C
Explanation: Appropriate organizational positioning and functional reporting to the audit committee help protect internal audit independence. Independence is supported by governance arrangements, not simply by professional certification.
Question 11
An external audit firm is auditing a company's cybersecurity controls. The lead auditor owns a significant financial interest in the company being audited. What should the firm do?
A. Continue the audit because the auditor works for an external firm.
B. Disclose and evaluate the conflict, and take appropriate action to eliminate or mitigate the independence threat, including replacing the auditor where necessary.
C. Allow the auditor to continue if management agrees.
D. Treat independence as irrelevant because the audit is technical.
Correct answer: B
Explanation: External auditors must maintain independence and avoid conflicts of interest that impair, or appear to impair, their objectivity. Working for an external firm does not automatically guarantee independence.
Case Study 5: Assurance Methods and External Reliance
A software company supplies a payment-processing platform to banks. A licensing authority requires independent evidence that the platform meets specified security and control requirements. The company has already completed an internal self-assessment and received a report from its IT department.
Question 12
Which assurance method is generally the MOST appropriate for satisfying a requirement for independent external assurance?
A. Internal self-assessment
B. Informal management review
C. Independent audit meeting the authority's requirements
D. Verbal confirmation from the IT manager
Correct answer: C
Explanation: Where an external authority requires independent assurance, an appropriately scoped and independent audit is generally suitable. The authority's specific rules determine which report or assurance framework is acceptable.
Question 13
The company's management argues that its internal audit report should automatically satisfy the licensing authority because the internal audit team is qualified. Which response is BEST?
A. All internal audit reports are automatically accepted by licensing authorities.
B. The authority's requirements must be checked because internal audit reports may not meet its independence, scope, or reporting criteria.
C. A qualified internal auditor always provides greater assurance than an external auditor.
D. Internal audits cannot provide any assurance.
Correct answer: B
Explanation: Acceptance depends on the applicable regulatory or licensing requirements, including the required independence, scope, evidence, and reporting format. An internal audit can provide valuable assurance without necessarily meeting every external requirement.
Question 14
A company commissions a consultant to assess its disaster recovery arrangements. The consultant identifies gaps in backup procedures but does not independently test whether the controls operate effectively. Management wants to use the report as proof of compliance.
What is the auditor's or assessor's MOST important consideration?
A. The report's title must contain the word audit.
B. The report should be accepted because the consultant is experienced.
C. The actual scope, procedures, evidence, limitations, and level of assurance must be evaluated before determining whether the report supports the compliance claim.
D. Any written report provides sufficient assurance for external use.
Correct answer: C
Explanation: The label on a report does not determine the assurance it provides. Its scope, testing, evidence, independence, and limitations determine whether it supports the intended purpose.
section b :
6. What is the definition of a standard as compared to a guideline ?
A. Standards are discretionary controls used with guidelines to aid the reader’s decision
process.
B. Standards are mandatory controls designed to support a policy. Following guidelines is
discretionary.
C. Guidelines are recommended controls necessary to support standards, which are
discretionary.
D. Guidelines are intended to designate a policy, whereas standards are used in the
absence of a policy.
7. Which of the following is not defined as a nonaudit role?
A. System designer
B. Operational staff member
C. Auditor
D. Organizational manager
8. Which of the following is the best description of an ongoing audit program for regulatory
compliance?
A. An audit is performed once for the entire year and then repeated by using the same
information for each successive year.
B. An audit may be automated by using audit program software.
C. An audit is a series of unique projects of short duration that add up to cover all the
steps necessary for annual compliance.
D. An audit is a series of assessments performed by the auditee for the purpose of licensing
and regulatory compliance.
9. What is the purpose of ISACA’s professional ethics statement?
A. To clearly specify acceptable and unacceptable behavior
B. To provide procedural advisement to the new IS auditor
C. To provide instructions on how to deal with irregularities and illegal acts by the client
D. To provide advice on when it is acceptable for the auditor to deviate from audit
standards
10. The auditor’s final opinion is to be based on which of the following?
A. The objectives and verbal statements made by management
B. An understanding of management’s desired audit results
C. The audit committee’s specifications
D. The results of evidence and testing
54 Chapter 1 ■ Secrets of a Successful Auditor
11. What are common types of audits?
A. Forensic, accounting, verification, regulatory
B. Integrated, operational, compliance, administrative
C. Financial, SAS‐74, compliance, administrative
D. Information systems, SAS‐70, regulatory, procedural
12. What is the difference between a policy and a procedure?
A. Compliance to a policy is discretionary, and compliance to a procedure is mandatory.
B. A procedure provides discretionary advice to aid in decision making. The policy
defines specific requirements to ensure compliance.
C. A policy is a high‐level document signed by a person of authority, and compliance is
mandatory. A procedure defines the mandatory steps to attain compliance.
D. A policy is a mid‐level document issued to advise the reader of desired actions in the
absence of a standard. The procedure describes suggested steps to use.
13. What is the purpose of standard terms of reference?
A. To meet the legal requirement of regulatory compliance
B. To prove who is responsible
C. To ensure honest and unbiased communication
D. To ensure that requirements are clearly identified in a regulation
14. Which of the following in a business organization will be held liable by the government for
failures of internal controls?
A. President, vice presidents, and other true corporate officers
B. Board of directors, president, vice presidents, department directors, and managers
C. All members of management
D. Board of directors, CEO, CFO, CIO, and department directors
15. Which of the following is true concerning the roles of data owner, data user, and data
custodian?
A. The data user implements controls as necessary.
B. The data custodian is responsible for specifying acceptable usage.
C. The data owner specifies controls.
D. The data custodian specifies security classification.
Review Questions 55
16. What does fiduciary responsibility mean?
A. To use information gained for personal interests without breaching confidentiality of
the client.
B. To act for the benefit of another person and place the responsibilities to be fair and
honest ahead of your own interest.
C. To follow the desires of the client and maintain total confidentiality even if illegal acts
are discovered. The auditor shall never disclose information from an audit in order to
protect the client.
D. None of the above.
17. How does the auditor derive a final opinion?
A. From evidence gathered and the auditor’s observations
B. By representations and assurances of management
C. By testing the compliance of language used in organizational policies
D. Under advice of the audit committee
18. How should the auditor assist in the remediation of problems found during the audit?
A. The auditor should take ownership of the issue and participate in designing the plan
for fixing the problem.
B. The auditor should decide whether the problem is major or minor and then advise the
auditee with a specific solution after considering the impact to the business.
C. The auditor should help the auditees. The auditor can add value by defining the specific
steps necessary for remediation of the problem.
D. The auditor should never take ownership of problems found. Auditors are encouraged
to provide general advice to the auditee, including an explanation of what to look for
during the audit.
19. The type of audit checks attributes against the design specifications.
A. Process
B. System
C. Compliance
D. Product
20. Why is it necessary to protect audit documentation and work papers?
A. The evidence gathered in an audit must be disclosed for regulatory compliance.
B. A paper trail is necessary to prove the auditor is right and the auditee is wrong.
C. The auditor will have to prove illegal activity in a court of law.
D. Audit documentation work papers may reveal confidential information that should not
be lost or disclosed.
56 Chapter 1 ■ Secrets of a Successful Auditor
21. What is the difference between the words should and shall when used in regulations?
A. Shall represents discretionary requirements, and should provides advice to the reader.
B. Should indicates mandatory actions, whereas shall provides advisory information
recommending actions when appropriate.
C. Should and shall are comparable in meaning. The difference is based on the individual
circumstances faced by the audit.
D. Should indicates actions that are discretionary according to need, whereas shall means
the action is mandatory regardless of financial impact.
22. The audit may uncover irregularities and illegal acts that require disclosure. The auditor is
obligated to promptly disclose this information to the authorities.
A. True
B. False
23. Which of the following statements is not true regarding the audit committee?
A. Executives inside the organization oversee the audit committee and are responsible for
keeping the committee busy working on compliance programs.
B. Executives can be hired and fired by the audit committee because this committee is
responsible for management oversight.
C. The audit committee is composed of members from the board of directors. This
committee has the authority to hire external auditors, and external auditors may meet
with the committee on a quarterly basis without other executives present.
D. The audit committee provides senior executives a method of bringing problems into a
confidential discussion for the purpose of exploring a resolution.
24. What term simply means the right people of authority looked at the issue, made an
intelligent decision, and took appropriate action?
A. Leadership
B. Corporate responsibility
C. Chain of command
D. Governance
25. What is the difference between a threat and a vulnerability?
A. Threats are the path that can be exploited by a vulnerability.
B. Threats are risks and become a vulnerability if they occur.
C. Vulnerabilities are a path that can be taken by a threat, resulting in a loss.
D. Vulnerability is a negative event that will cause a loss if it occurs.
answer section b:
6. B. A standard is implemented to ensure a minimum level of uniform compliance.
Guidelines are advisory information used in the absence of a standard. Compliance to
standards is mandatory; compliance to guidelines is discretionary.
7. C. Every role except an auditor is a nonaudit role. Anyone in a nonaudit role is
disqualified from being an independent auditor.
8. C. Projects are unique and usually of limited duration, for a fixed period of time with
a definite start and stop date. The projects may be coupled into a series of projects
to fulfill an ongoing operational need, such as an annual audit program or perpetual
quality program.
9. A. This statement specifies that IS auditors are expected to fulfill their duties with the
highest standards of honest and truthful representation. It is unacceptable to violate
the fiduciary relationship with your client.
10. D. The auditor is to be a professional skeptic who tests assertions of management and
renders an opinion based on the evidence discovered during the audit.
11. B. All of the audit types listed are valid except procedural, SAS‐74, verification,
and regulatory. The valid audit types are financial, operational (SAS‐70), integrated
(SAS‐94), compliance, administrative, forensic, and information systems. A forensic
audit is used to discover information about a possible crime.
Chapter 1: Secrets of a Successful Auditor 573
12. C. A policy is signed by the person of highest authority to ensure compliance by the
members of the organization. Compliance to policies, standards, and procedures is
mandatory.
13. C. Standard terms of reference are used between the auditor and everyone else to ensure
honest and unbiased communication. Without standard terminology, it would be difficult
to know whether we were discussing the same issue or agreed on the same outcome.
14. A. Officers of the organization will typically hold the title of vice president or higher.
A CIO might not be a corporate officer, unless the position is located in the parent
organization. A division‐level CIO may or may not be a true corporate officer. Those
holding the position of department director and below are seldom held liable by the
government for internal control failure. A department director is a supporting manager
to the vice president.
15. C. The data owner specifies controls, is responsible for acceptable use, and appoints
the data custodian. The data users will comply with acceptable use and report
violations. The data custodian will protect information and ensure its availability. The
custodian will also provide support to the users.
16. B. Accountants, auditors, and lawyers act on behalf of their client’s best interests
unless doing so places them in violation of the law. It is the highest standard of duty
implied by law for a trustee and guardian.
17. A. A final opinion is based on evidence gathered and testing. The purpose of an audit
is to challenge the assertions of management. Evidence is gathered that will support or
disprove claims.
18. D. The auditor must never take ownership of the problems found. The auditor may
provide general advice to the auditee and demonstrate what they are looking for during
the audit. The auditee needs to design their own remediation plan. Auditors who
participate in detailed remediation planning are no longer objective nor independent.
19. D. Product audits compare design specifications (feature, size, color, markings, and
so forth) against the attributes of the finished product. The CISA may use this type
of audit during certification of custom‐built software programs or prior to software
release from a development company.
20. D. The auditor may discover information that could cause some level of damage to the
client if disclosed. The information could trigger additional actions by a perpetrator.
In addition, the auditor shall implement controls to ensure security and data backup of
their work.
21. D. Should represents discretionary i d nformation in a regulation. Shall indicates that
compliance is mandatory regardless of profit or loss.
22. B. The auditor should contact one level of management above where the suspected
activity took place. If the problem involved managers responsible for internal controls,
the auditor should report it to the highest level of management available, which is
usually the audit committee. Auditors should never contact the authorities directly
unless advised to do so by their own attorney.
574 Appendix ■ Answers to Review Questions
23. A. All of the answers except A are true. The audit committee is responsible for
management oversight of the executives. The audit committee is usually composed of
board members who provide executives a forum to discuss problems in order to rectify
the situation. The audit committee can hire or fire anyone in the organization, usually
focusing their attention on external auditors and senior executives.
24. D. Governance means the right people of authority made a decision. Governance
occurs at the top level of management to prevent anarchy. Decisions made at too low a
level below the executives may be an indicator of lack of governance.
25. C. Threats are negative events that cause a loss if they occur. Vulnerabilities are paths
that allow a threat to occur.
section c;
|
Quick Revision: CISA Domain 1
Concept | Exam-ready takeaway |
|---|---|
Assessment vs. audit | Assessments commonly identify gaps; audits follow a systematic, evidence-based process. |
Auditor | Performs audit procedures and evaluates evidence. |
Auditee | The person, function, or organization being examined. |
Client | The party commissioning or requesting the engagement. |
Organizational policies | Require authorization from appropriate senior management or governing authority. |
Auditor independence | Protects unbiased judgment and credible assurance. |
Internal audit | Provides assurance while avoiding inappropriate management responsibilities. |
External assurance | Must meet the intended user's or regulator's specific requirements. |
Scope limitation | Investigate, document, and evaluate its impact on the audit conclusion. |
Evidence | Conclusions must be supported by sufficient, appropriate evidence. |
Exam tip for students: In CISA Domain 1, focus on what the auditor should do FIRST, what is MOST appropriate, and which action best protects independence, objectivity, evidence quality, and governance. These questions test judgment, not just definitions.
These are original practice questions based on the concepts in your supplied MCQs, not official ISACA examination questions.
No comments:
Post a Comment