MCQ Questions are designed for CISA aspirants to strengthen their understanding of the Information Systems Auditing Process. They cover audit planning, risk assessment, audit evidence, internal controls, audit testing, sampling, reporting, IT governance, and professional ethics.
How to use these MCQs
- Attempt each question before checking the answer.
- Focus on why the correct option is best, especially when two options appear reasonable.
- Remember the CISA exam principle: choose the answer that best protects business objectives, maintains auditor independence, and provides sufficient, reliable evidence.
These are original practice questions, not actual or recalled ISACA examination questions.
Section A: Audit Standards, Ethics and Fundamentals (1–10)
1. What is the primary objective of an information systems audit?
A. To identify every error in the accounting records B. To evaluate whether information systems and related controls support business objectives C. To eliminate all business risks D. To ensure that IT expenditure is minimized
Answer: B. An IS audit evaluates controls, risks, and system performance in relation to business objectives.
2. Which quality is MOST important for an IS auditor when evaluating controls?
A. Personal friendship with management B. Independence and objectivity C. Technical knowledge alone D. Seniority within the organization
Answer: B. Independence and objectivity help ensure unbiased conclusions.
3. An IS auditor discovers a significant control weakness in a system managed by a close friend. What should the auditor do FIRST?
A. Ignore the weakness B. Discuss it privately with the friend and close the audit C. Disclose the potential conflict of interest through the appropriate process D. Modify the audit findings
Answer: C. Potential conflicts must be disclosed and appropriately managed to preserve objectivity.
4. Which document formally establishes the authority, responsibility, and purpose of the internal audit function?
A. Audit engagement letter B. Internal audit charter C. System development plan D. Business continuity plan
Answer: B. The audit charter defines the internal audit function's purpose, authority, and responsibilities.
5. Which of the following is the BEST example of due professional care?
A. Completing an audit as quickly as possible B. Applying appropriate professional judgment, skepticism, and diligence C. Accepting management's explanations without verification D. Testing only controls that are easy to evaluate
Answer: B. Due professional care requires reasonable diligence and judgment, not a guarantee that every issue will be found.
6. What is the primary purpose of an audit engagement letter?
A. To replace the internal audit charter B. To document the scope, objectives, responsibilities, and agreed arrangements for an engagement C. To guarantee that no fraud exists D. To approve all IT expenditure
Answer: B. An engagement letter or equivalent communication establishes the understanding for the specific audit.
7. Which action BEST demonstrates professional skepticism?
A. Accepting all management representations B. Assuming all employees are dishonest C. Corroborating important representations with independent evidence D. Avoiding interviews with system administrators
Answer: C. Professional skepticism means questioning appropriately and validating important claims.
8. Which party is ultimately responsible for establishing and maintaining effective internal controls?
A. External auditor B. Internal auditor C. Management D. Audit software vendor
Answer: C. Management owns and operates internal controls; auditors independently evaluate them.
9. What should an IS auditor do if assigned to audit a control that the auditor personally designed and implemented?
A. Proceed without disclosure B. Evaluate and address the impairment to objectivity, including reassignment if necessary C. Automatically approve the control D. Cancel the entire audit function
Answer: B. Auditing one's own work creates a self-review threat that must be appropriately managed.
10. Which statement BEST describes the purpose of audit documentation?
A. To replace the final audit report B. To record sufficient evidence of the work performed, results obtained, and conclusions reached C. To document only control failures D. To ensure that management agrees with every finding
Answer: B. Working papers support conclusions and allow appropriate review of the audit work.
Section B: Risk-Based Audit Planning (11–20)
11. What should an IS auditor generally do FIRST when planning an audit?
A. Prepare the final report B. Understand the business, its objectives, and the area under review C. Recommend new software D. Select the audit sample
Answer: B. Understanding the business context allows the auditor to identify relevant risks and objectives.
12. Which system should generally receive the HIGHEST audit priority?
A. A low-impact system used by a few employees B. A critical payment system processing sensitive transactions C. A training system with no production data D. An inactive test server
Answer: B. Criticality, financial exposure, data sensitivity, and potential business impact influence audit priority.
13. What is the primary purpose of a risk assessment during audit planning?
A. To eliminate all risks B. To identify and prioritize risks that could prevent business objectives from being achieved C. To prepare employee salaries D. To determine the organization's tax liability
Answer: B. Risk assessment directs audit resources toward the areas of greatest concern.
14. A company introduces a new cloud-based financial system. What should the IS auditor do?
A. Wait until the system has operated for five years B. Assess relevant risks and consider the system for risk-based audit coverage C. Assume the cloud provider manages every risk D. Audit only the physical office
Answer: B. New technologies can introduce risks involving access, configuration, data protection, and third-party dependencies.
15. Which factor is MOST important when determining the scope of an audit?
A. The auditor's personal preference B. Audit objectives, significant risks, and relevant business processes C. The number of employees in the IT department alone D. The age of the audit software
Answer: B. Scope should be aligned with the audit objectives and the risks that could affect them.
16. What is inherent risk?
A. Risk remaining after controls operate B. Risk arising before considering the effect of related controls C. Risk caused only by auditors D. Risk that has been completely eliminated
Answer: B. Inherent risk exists because of the nature of an activity, system, or environment.
17. What is residual risk?
A. Risk before any controls are considered B. Risk remaining after risk responses and controls are considered C. Risk that cannot be measured D. Risk caused only by external hackers
Answer: B. Residual risk is what remains after the organization's risk responses.
18. A business application has strong access controls but no tested recovery procedure. Which risk deserves attention?
A. Business interruption following a system failure B. Excessive office stationery costs C. Incorrect employee uniforms D. Low printer utilization only
Answer: A. Access controls do not replace disaster recovery and business continuity arrangements.
19. Why should an auditor understand the organization's risk appetite?
A. To approve every business decision B. To assess whether identified risks and responses align with management's accepted risk levels C. To avoid reporting high risks D. To replace technical testing
Answer: B. Risk appetite helps provide context for evaluating risk acceptance and mitigation.
20. Management refuses to remediate a significant risk identified during an audit. What is the BEST course of action for the auditor?
A. Silently close the finding B. Change the risk rating to low C. Escalate the matter through appropriate governance channels D. Implement the control without authorization
Answer: C. Significant risk acceptance should be escalated to the appropriate level when necessary.
Section C: Audit Evidence and Documentation (21–30)
21. Which type of audit evidence is generally MOST reliable?
A. An unsupported verbal statement B. A screenshot supplied by an unknown source C. Relevant evidence obtained directly by the auditor from a reliable system D. An unsigned internal note
Answer: C. Directly obtained, reliable evidence generally provides stronger support, although its quality must still be assessed.
22. What is the primary purpose of an audit trail?
A. To prevent employees from taking leave B. To trace transactions and activities from their origin through processing and reporting C. To eliminate the need for backups D. To replace access controls
Answer: B. Audit trails support traceability, accountability, and investigation.
23. An auditor receives a system-generated report from management. What should the auditor consider FIRST before relying on it?
A. Whether it is printed in color B. Whether its completeness and accuracy are reliable for the audit purpose C. Whether the report is short D. Whether management prefers the report
Answer: B. Information produced by the entity (IPE) should be validated for completeness and accuracy as relevant to the test.
24. Which evidence is generally stronger when confirming that an access review was performed?
A. A manager's unsupported statement B. A dated, approved review record corroborated by relevant system evidence C. An undated blank form D. A draft policy that was never implemented
Answer: B. Corroborated evidence supports both the performance and timing of the control.
25. What is the main purpose of an audit working paper?
A. To advertise the audit department B. To document procedures, evidence, findings, and conclusions C. To replace system logs D. To approve employee promotions
Answer: B. Working papers establish the basis for audit conclusions and facilitate supervisory review.
26. An auditor finds inconsistent timestamps in system logs. What is the BEST next step?
A. Ignore the inconsistency B. Investigate the cause and assess its impact on the reliability of the evidence C. Delete the logs D. Conclude immediately that fraud occurred
Answer: B. Inconsistent timestamps may indicate clock synchronization issues, configuration problems, or other concerns requiring investigation.
27. Which factor is MOST important when evaluating audit evidence?
A. Its volume alone B. Its relevance, reliability, and sufficiency C. The seniority of the person presenting it D. Its formatting
Answer: B. Evidence must adequately and reliably support the audit conclusion.
28. What should an auditor do when evidence is insufficient to support a conclusion?
A. Guess the likely outcome B. Obtain additional appropriate evidence or clearly qualify the conclusion C. Report that the control is effective anyway D. Remove the issue from the working papers
Answer: B. Conclusions must be supported by adequate evidence, with limitations disclosed where necessary.
29. Which is the BEST example of corroborating evidence?
A. Repeating the same verbal statement twice B. Comparing a system access log with an approved access request C. Asking the same manager the same question D. Copying an unverified spreadsheet
Answer: B. Comparing independent records can help establish whether system access was properly authorized.
30. Why is a chain of custody important when collecting digital evidence?
A. It reduces the cost of software licensing B. It documents possession, transfer, handling, and integrity of the evidence C. It guarantees a successful prosecution D. It replaces encryption
Answer: B. A documented chain of custody helps demonstrate that digital evidence has been handled appropriately and has not been improperly altered.
Section D: Internal Controls and Control Testing (31–40)
31. Which of the following is a preventive control?
A. Reviewing a monthly exception report B. Blocking unauthorized access through role-based permissions C. Investigating a completed fraud D. Reconciling bank statements after month-end
Answer: B. Preventive controls aim to stop an undesirable event before it occurs.
32. Which of the following is a detective control?
A. A firewall rule blocking unauthorized traffic B. A password complexity requirement C. A review of logs to identify suspicious activity D. A system validation that rejects invalid input
Answer: C. Detective controls identify events or failures that have already occurred or are occurring.
33. Which is the BEST example of a corrective control?
A. A procedure that restores data from a verified backup after data loss B. A password policy C. A user access approval form D. A security awareness poster
Answer: A. Corrective controls help restore systems or remediate problems after an incident.
34. What is the main objective of segregation of duties (SoD)?
A. To increase the number of employees B. To reduce the opportunity for errors or fraud by separating incompatible responsibilities C. To eliminate management supervision D. To ensure that only one employee can access a system
Answer: B. Dividing authorization, execution, recording, and review responsibilities reduces the risk of abuse.
35. A developer can write program code and move it directly into production without review. What is the PRIMARY concern?
A. Excessive office expenses B. Unauthorized or inadequately tested changes entering production C. Inadequate marketing D. Slow employee recruitment
Answer: B. Development and production access should be appropriately separated, with controlled deployment and review.
36. What is the BEST way to test whether a user access approval control operated effectively?
A. Read the access policy only B. Sample access grants and compare them with valid, authorized approvals C. Ask users whether they like the system D. Review the company's annual report only
Answer: B. Operating-effectiveness testing examines whether the control actually operated as intended.
37. What does a walkthrough primarily help an auditor understand?
A. The annual salary structure B. How a transaction or process flows through the system and its controls C. The market value of company shares D. The physical size of a server room
Answer: B. A walkthrough traces a transaction through relevant process steps and controls.
38. What is the difference between control design effectiveness and operating effectiveness?
A. There is no difference B. Design effectiveness asks whether the control could address the risk; operating effectiveness asks whether it operated as intended C. Design effectiveness applies only to hardware D. Operating effectiveness is evaluated without evidence
Answer: B. A well-designed control can still fail if it is not consistently implemented or performed.
39. Which is the BEST example of an application control?
A. A server room access card B. A system validation rejecting a transaction with a missing mandatory field C. An enterprise-wide recruitment policy D. A building fire drill
Answer: B. Application controls validate, process, authorize, or reconcile transactions within an application.
40. What is the purpose of general IT controls (ITGCs)?
A. To control only individual invoice calculations B. To support the reliable and secure operation of IT systems and applications C. To replace all application controls D. To determine product selling prices
Answer: B. ITGCs include controls over access, program changes, IT operations, and related technology processes.
Section E: Audit Procedures, Testing and Sampling (41–50)
41. Which procedure provides the STRONGEST evidence that a control is operating effectively?
A. Reading the policy B. Asking the control owner whether the control operates C. Testing a representative selection of actual control instances using appropriate evidence D. Reviewing the organization chart
Answer: C. Actual operating evidence is generally stronger than inquiry alone.
42. What is substantive testing primarily designed to identify?
A. Whether employees attended training B. Material errors or misstatements in transactions, balances, or data C. Whether the audit team has enough members D. Whether a policy has a suitable title
Answer: B. Substantive procedures directly examine data, transactions, or balances for errors or misstatements.
43. What is the primary purpose of a test of controls?
A. To determine whether a control operated effectively B. To calculate the company's tax rate C. To create a new IT system D. To replace risk assessment
Answer: A. Tests of controls evaluate the implementation and operating effectiveness of relevant controls.
44. An auditor wants to determine whether all terminated employees had their access revoked. Which approach is BEST?
A. Select a sample of terminated employees and verify termination dates against access-removal records and system status B. Interview only the IT director C. Review the office attendance register D. Examine only active employees
Answer: A. This directly tests whether the access-removal control operated for the population under review.
45. What is the primary purpose of audit sampling?
A. To avoid collecting evidence B. To draw a conclusion about a population by testing selected items C. To guarantee that no errors exist D. To select only error-free transactions
Answer: B. Sampling provides a basis for evaluating a population without testing every item.
46. What is sampling risk?
A. The risk that the sample-based conclusion differs from the conclusion that would result from examining the entire population B. The risk that an employee resigns C. The cost of printing sample documents D. The risk that audit software becomes outdated
Answer: A. Sampling risk arises because only a subset of the population is examined.
47. Which sampling method gives every item in the population a known chance of selection?
A. Judgmental selection without a defined selection method B. Statistical random sampling C. Selecting only the first five records D. Selecting records recommended by management
Answer: B. Statistical random sampling uses a random selection process with known selection probabilities.
48. An auditor examines every transaction above ₹10 lakh and samples smaller transactions. What is this an example of?
A. Risk-based stratification and targeted testing B. Complete testing of every transaction C. Random sampling of the entire population D. Inquiry-only auditing
Answer: A. Separating high-value transactions for specific testing can improve coverage of significant exposures.
49. During control testing, an auditor discovers more deviations than expected. What should the auditor do?
A. Ignore the deviations B. Evaluate their nature and cause, reassess the control risk, and extend or modify testing as appropriate C. Automatically declare the entire system fraudulent D. Delete the sample results
Answer: B. Unexpected deviations can affect the assessed reliability of the control and the audit approach.
50. What is the BEST reason to use computer-assisted audit techniques (CAATs)?
A. To eliminate the need for professional judgment B. To analyze large data sets efficiently and identify exceptions or unusual patterns C. To guarantee that every fraud will be detected D. To avoid validating source data
Answer: B. CAATs help analyze data at scale, but their results depend on reliable data and suitable procedures.
Section F: Audit Findings, Reporting and Follow-Up (51–60)
51. Which set of elements BEST supports a well-developed audit finding?
A. Employee name, salary, and department B. Condition, criteria, cause, effect or risk, and recommendation C. Software brand, color, and version D. Budget, revenue, and advertising expense only
Answer: B. These elements explain what was found, what should have happened, why the gap occurred, and why it matters.
52. In audit reporting, what does “condition” mean?
A. The expected control requirement B. The actual situation identified by the auditor C. The recommended future action D. The audit department's annual budget
Answer: B. Condition describes the observed state of affairs.
53. What does “criteria” refer to in an audit finding?
A. The standard, policy, procedure, or requirement against which the condition is evaluated B. The number of auditors assigned C. The software's purchase price D. The auditor's personal opinion
Answer: A. Criteria define the expected or required state.
54. An access review was not performed because the review process had no assigned owner. What is the likely root cause?
A. The absence of clear control ownership B. A failed printer C. High internet speed D. Excessive backup storage
Answer: A. Root-cause analysis seeks the underlying reason a control failed, rather than merely restating the failure.
55. Which recommendation is generally the MOST effective?
A. “Be more careful.” B. “Improve security.” C. “Assign a control owner, establish a documented quarterly access review, and retain evidence of completion.” D. “Avoid all technology.”
Answer: C. A specific, actionable recommendation addresses the control gap and creates accountability.
56. Who is normally responsible for implementing corrective actions arising from an internal audit?
A. Management and the designated process owners B. The auditor alone C. External customers D. The software vendor in every case
Answer: A. Management owns remediation; auditors evaluate and follow up on its effectiveness.
57. What is the main purpose of audit follow-up?
A. To repeat the original audit report word for word B. To verify whether agreed corrective actions were implemented and adequately address the risk C. To eliminate the need for future audits D. To guarantee that no future incidents occur
Answer: B. Follow-up confirms implementation and, where appropriate, tests whether remediation works.
58. Management disagrees with an audit finding. What should the auditor do?
A. Remove the finding automatically B. Evaluate the evidence objectively, discuss the disagreement, and resolve or report the issue through the appropriate process C. Stop documenting the audit D. Accept management's view without review
Answer: B. Findings should be evidence-based, and disagreements should be handled professionally.
59. Which finding should generally receive the HIGHEST reporting priority?
A. A minor formatting inconsistency in an internal document B. A critical vulnerability that exposes sensitive customer information C. An outdated office seating chart D. A small delay in printing reports
Answer: B. Potential impact, likelihood, urgency, and exposure of sensitive information influence severity.
60. A critical audit finding remains unresolved, and management's proposed deadline is considered too late for the level of risk. What is the BEST action?
A. Wait silently until the deadline B. Escalate the risk and remediation timing concern to the appropriate level of governance C. Close the finding based on the promise D. Remove the finding from the report
Answer: B. Significant unresolved risks require timely escalation and appropriate oversight.
Section G: IT Governance, Risk Management and Compliance (61–70)
61. What is the primary purpose of IT governance?
A. To ensure that IT supports business strategy and delivers value while managing risk B. To eliminate every IT employee position C. To purchase the most expensive technology D. To centralize every business decision with the auditor
Answer: A. IT governance aligns technology decisions, accountability, performance, and risk with business objectives.
62. Which framework is widely used for enterprise IT governance and management?
A. COBIT B. FIFO C. LIFO D. EOQ
Answer: A. COBIT provides a framework for the governance and management of enterprise information and technology.
63. What is the primary purpose of an IT risk register?
A. To record employee attendance B. To document identified risks, their assessment, ownership, and responses C. To store passwords in plain text D. To replace the organization's financial statements
Answer: B. A risk register supports monitoring, accountability, and decisions about risk treatment.
64. Which statement BEST describes risk mitigation?
A. Taking action to reduce the likelihood or impact of a risk B. Ignoring the risk C. Transferring every business responsibility to auditors D. Guaranteeing that the risk can never occur
Answer: A. Mitigation reduces exposure through controls or other risk responses.
65. A company buys cyber insurance. Which risk response does this MOST closely represent?
A. Risk avoidance B. Risk transfer or sharing C. Risk elimination D. Risk identification only
Answer: B. Insurance transfers some financial consequences to an insurer, but it does not remove the underlying cyber risk.
66. Which situation BEST illustrates risk avoidance?
A. Installing an intrusion detection system B. Discontinuing a particularly risky activity C. Accepting a low-level risk D. Buying cyber insurance
Answer: B. Risk avoidance means deciding not to start or continue the activity that creates the risk.
67. What is the purpose of a business impact analysis (BIA)?
A. To identify critical business activities and assess the consequences of disruption B. To calculate employee income tax C. To approve software licenses D. To evaluate only the color of a disaster recovery dashboard
Answer: A. A BIA helps determine recovery priorities and acceptable disruption periods.
68. Which metric specifies the maximum targeted duration of data loss measured in time?
A. RTO B. RPO C. ROI D. SLA
Answer: B. The Recovery Point Objective (RPO) defines the acceptable data-loss window measured in time.
69. What does the Recovery Time Objective (RTO) represent?
A. The maximum targeted time to restore a service after disruption B. The amount of data that can be lost C. The annual cost of IT equipment D. The time required to complete an audit report
Answer: A. RTO is the targeted recovery time for a system or business service.
70. Which activity provides the BEST assurance that a disaster recovery plan is workable?
A. Keeping a copy of the plan without reviewing it B. Periodically testing the plan and documenting results, gaps, and corrective actions C. Asking one employee whether the plan looks adequate D. Buying additional servers without testing recovery
Answer: B. Testing reveals whether recovery procedures, people, technology, and dependencies work as intended.
Section H: IT Operations, Access and Change Management (71–80)
71. What is the primary purpose of least privilege?
A. To give users maximum access B. To grant only the access necessary to perform assigned duties C. To remove all user accounts D. To permit shared administrator accounts
Answer: B. Least privilege limits the damage that errors, compromised accounts, or misuse can cause.
72. Why should privileged user activity be logged and monitored?
A. Privileged accounts have elevated capabilities and can cause significant damage if misused B. Privileged users never make mistakes C. Logging replaces access authorization D. Monitoring is needed only for ordinary users
Answer: A. Monitoring supports accountability and the detection of unauthorized or suspicious privileged activity.
73. What is the MOST important control when implementing a production system change?
A. Allowing developers to make changes whenever they wish B. Documented authorization, appropriate testing, and controlled deployment C. Disabling all change logs D. Avoiding rollback procedures
Answer: B. Change management reduces the risk of unauthorized changes and service disruption.
74. An emergency system change is necessary to resolve a severe outage. What is the BEST practice?
A. Never document the change B. Use an approved emergency process with appropriate authorization, logging, and retrospective review C. Allow any employee to change production D. Avoid testing whenever possible, regardless of risk
Answer: B. Emergency changes may need expedited handling but should remain controlled and traceable.
75. Why should development, testing, and production environments be separated?
A. To increase duplication without benefit B. To reduce unauthorized changes and prevent untested code from affecting live operations C. To eliminate the need for backups D. To ensure developers cannot access documentation
Answer: B. Separation and controlled promotion help protect production integrity and availability.
76. Which control BEST helps prevent unauthorized software installation on corporate endpoints?
A. Unrestricted administrator rights for every user B. Application allowlisting and controlled installation privileges C. Disabling endpoint monitoring D. Sharing administrator passwords
Answer: B. Allowlisting and restricted installation privileges limit unauthorized software execution and installation.
77. What is the primary purpose of database activity monitoring?
A. To detect unusual or unauthorized database activity B. To prepare marketing campaigns C. To replace all database access controls D. To increase the number of database tables
Answer: A. Monitoring can reveal suspicious queries, access patterns, and potentially unauthorized changes.
78. Which is the BEST control over backup media containing confidential information?
A. Leaving it unprotected in a public area B. Applying appropriate encryption, access restrictions, and secure storage C. Sharing it with every employee D. Removing all inventory records
Answer: B. Backup protection must address confidentiality, integrity, availability, and physical security.
79. What is the primary purpose of a security patch management process?
A. To apply relevant security updates in a controlled and timely manner B. To remove every business application C. To prevent all system testing D. To replace incident response
Answer: A. Patch management reduces exposure to known vulnerabilities while managing deployment risks.
80. A terminated employee's account remains active. Which control has most directly failed?
A. Timely user deprovisioning B. Budget forecasting C. Physical inventory valuation D. Financial statement consolidation
Answer: A. Termination procedures should trigger timely revocation of access across relevant systems.
Section I: Information Security, Incident Management and Third Parties (81–90)
81. What is the primary objective of an information security policy?
A. To describe only the IT department's budget B. To establish management's security expectations, principles, and responsibilities C. To eliminate the need for security controls D. To guarantee that no security incident occurs
Answer: B. A security policy establishes direction and expectations for protecting information assets.
82. Which of the following BEST demonstrates multi-factor authentication (MFA)?
A. Using two passwords B. Using a password and a fingerprint C. Using the same password twice D. Using a username and a password only
Answer: B. MFA uses different authentication factor types, such as something you know and something you are.
83. An employee receives a suspicious email requesting login credentials. What is the BEST immediate response?
A. Reply with the requested password B. Forward it to colleagues to test whether it is genuine C. Report it through the organization's approved security reporting process D. Disable the organization's entire network
Answer: C. Prompt reporting enables security personnel to investigate and contain potential phishing attacks.
84. What is the primary purpose of an incident response plan?
A. To establish procedures for identifying, containing, investigating, and recovering from incidents B. To guarantee that incidents never occur C. To replace preventive security controls D. To eliminate the need for incident documentation
Answer: A. Incident response aims to manage the effects of security incidents and restore operations appropriately.
85. An auditor finds that critical security logs are overwritten every day, preventing investigations of incidents discovered weeks later. What is the MAIN concern?
A. Insufficient log retention for investigation and monitoring requirements B. Excessive employee training C. Too many application features D. Excessive physical security
Answer: A. Log retention should support security monitoring, investigations, legal obligations, and organizational requirements.
86. What is the primary objective of a vulnerability assessment?
A. To identify and evaluate security weaknesses B. To guarantee that a system cannot be attacked C. To replace every penetration test D. To approve employee promotions
Answer: A. Vulnerability assessments identify weaknesses and help prioritize remediation.
87. Which statement BEST describes penetration testing?
A. Reviewing a policy without testing the system B. Simulating authorized attacks to evaluate exploitable weaknesses C. Performing only an employee satisfaction survey D. Replacing business continuity planning
Answer: B. Penetration testing evaluates whether and how weaknesses can be exploited within an agreed scope.
88. A company outsources its payroll processing to a third party. What should the IS auditor focus on MOST?
A. The vendor's office decoration B. Security, access controls, contractual obligations, service performance, and oversight of the outsourced process C. The number of vendor employees alone D. Whether the vendor uses the same office furniture
Answer: B. Outsourcing does not remove the organization's responsibility to manage risks associated with the service.
89. What is the primary purpose of a service-level agreement (SLA)?
A. To define agreed service expectations, performance measures, and responsibilities B. To replace all cybersecurity policies C. To guarantee that no downtime will ever occur D. To provide unlimited access to customer data
Answer: A. An SLA documents measurable service expectations and associated responsibilities.
90. A cloud service provider refuses to share detailed security logs with its customer. What is the auditor's BEST response?
A. Assume the provider is secure B. Assess whether available assurance reports, contractual rights, alternative evidence, and monitoring arrangements adequately address the risk C. Automatically approve the provider D. Ignore the issue because the system is cloud-based
Answer: B. The auditor should evaluate whether sufficient reliable evidence and appropriate assurance over the outsourced service are available.
Section J: Integrated Scenarios and Exam-Level Judgment (91–100)
91. During an audit, management claims that all critical systems are backed up daily. What should the auditor do to obtain the BEST evidence of recoverability?
A. Accept the statement from management B. Review backup logs and observe or inspect evidence of successful restoration tests C. Read the backup policy only D. Count the number of IT employees
Answer: B. Backup completion does not establish recoverability; restoration testing provides stronger evidence.
92. An auditor discovers that the same employee creates vendors, approves invoices, and processes payments. What is the MOST significant concern?
A. Excessive segregation of duties B. Increased risk of fraud and unauthorized payments C. Excessive backup capacity D. Inadequate software documentation only
Answer: B. Combining incompatible duties creates opportunities for fictitious vendors, unauthorized invoices, and improper payments.
93. A bank's transaction-processing application occasionally processes the same payment twice. Which control would BEST address this problem?
A. A control that detects duplicate transaction identifiers before posting B. A longer employee induction program C. A stronger office access card D. A review of marketing expenditure
Answer: A. Duplicate detection and idempotency controls help prevent repeated processing of the same transaction.
94. An auditor identifies a vulnerability rated critical by a scanner. What should the auditor do FIRST?
A. Assume the organization has been compromised B. Validate the finding, assess the business exposure and existing controls, and determine the appropriate urgency C. Immediately shut down every system D. Ignore the finding if management is busy
Answer: B. Scanner results should be validated and assessed in context; critical exposures may require immediate escalation.
95. A company has a documented access control policy, but several employees have excessive privileges. What is the BEST audit conclusion?
A. The control is effective because a policy exists B. Policy documentation alone does not establish operating effectiveness; actual access must be evaluated C. No audit finding is possible D. Excessive privileges are always acceptable
Answer: B. The auditor must assess whether controls are implemented and operating effectively, not just documented.
96. An auditor's data analysis identifies an unusual payment pattern. What should the auditor do NEXT?
A. Conclude immediately that fraud has occurred B. Investigate the exceptions and obtain corroborating evidence before drawing conclusions C. Delete the analysis D. Publicly accuse the employee involved
Answer: B. An exception is an indicator requiring investigation, not proof of wrongdoing.
97. An organization has a high-risk legacy system that cannot be patched immediately. What is the BEST recommendation?
A. Ignore the vulnerability indefinitely B. Assess the exposure, implement proportionate compensating controls, establish a remediation plan, and escalate residual risk as appropriate C. Disable all monitoring D. Assume that old systems are immune to attacks
Answer: B. Compensating controls can reduce exposure while a realistic, accountable remediation plan is implemented.
98. During an audit, a manager asks the auditor to remove a substantiated finding because it could affect the manager's performance rating. What should the auditor do?
A. Remove the finding to maintain the relationship B. Retain the evidence-based finding and follow appropriate reporting and escalation procedures C. Destroy the working papers D. Replace the finding with an unrelated issue
Answer: B. Audit conclusions must remain objective and supported by evidence, regardless of management pressure.
99. An audit reveals that a control failed once during the review period. What is the BEST approach?
A. Conclude automatically that the entire control environment is ineffective B. Evaluate the deviation's cause, significance, frequency, and impact on the control objective C. Ignore the deviation because it happened only once D. Assume that fraud occurred
Answer: B. A single deviation may be significant or isolated; its meaning depends on the facts and risk context.
100. An IS auditor is nearing completion of an audit but has insufficient evidence to support the conclusion that a critical control is effective. What should the auditor do?
A. Report the control as effective to finish on time B. Obtain sufficient appropriate evidence or clearly communicate the limitation and its implications C. Ask management to select the conclusion D. Remove the control from the audit scope without explanation
Answer: B. Audit conclusions must be supported by sufficient appropriate evidence. Any material limitation must be handled transparently.
Final revision: High-value CISA Domain 1 concepts
Concept | Remember for the exam |
Independence | Avoid bias and disclose conflicts of interest |
Risk-based planning | Prioritize significant business risks |
Audit evidence | Evaluate relevance, reliability, and sufficiency |
Control design | Can the control address the identified risk? |
Operating effectiveness | Did the control actually work as intended? |
Audit findings | Condition, criteria, cause, effect/risk, recommendation |
Management responsibility | Management owns controls and remediation |
Audit follow-up | Verify implementation and effectiveness |
RPO | Acceptable data-loss window |
RTO | Targeted recovery time |
Preventive control | Prevents an undesirable event |
Detective control | Identifies an event or failure |
Corrective control | Restores or remediates after a problem |
Sampling risk | Sample conclusion may differ from the population conclusion |
Professional skepticism | Verify significant claims with reliable evidence |
STUDENTS ASSIGNMENTS:SOLVE THIS 25 QUESTIONS SUBMIT YOUR ANSWER...
CISA Domain 1 — Advanced Case-Based MCQs
Information Systems Auditing Process | Challenging Practice Set
These questions are designed for students who have completed the basic CISA Domain 1 MCQs and now need to practise scenario analysis, risk-based judgment, audit evidence evaluation, control testing, and the “BEST / FIRST / MOST important” style of questions.
The cases below are original practice scenarios, not actual ISACA exam questions.
Exam technique: Read the entire case, identify the auditor's objective, distinguish facts from assumptions, and select the option that best addresses the underlying risk without compromising audit independence.
Case Study 1: Privileged Access and Segregation of Duties
Questions 1–5
A multinational bank has implemented a new core banking application. During the audit, the IS auditor discovers that:
- Two database administrators have unrestricted access to production databases.
- One administrator can modify transaction records and delete audit logs.
- The bank's IT manager states that the administrators are trustworthy and that no incident has been reported.
- The system records administrative activities, but the administrators can modify or delete those records.
1. What is the auditor's GREATEST concern?
A. The bank has employed too many database administrators. B. The administrators can alter transactions and potentially conceal their actions. C. The bank's IT manager has not conducted enough interviews. D. The system has excessive storage capacity.
Correct answer:
2. What should the auditor do FIRST after discovering this condition?
A. Recommend terminating both administrators immediately. B. Determine the actual privileges, assess the exposure, and obtain evidence of how administrative activities are controlled and monitored. C. Conclude that fraud has occurred. D. Accept management's explanation because no incident has been reported.
Correct answer:
3. Which control would BEST address the risk that administrators could alter or delete their own audit records?
A. Increase the password length for administrator accounts. B. Store logs in a separately controlled, tamper-resistant logging environment. C. Require administrators to submit monthly leave applications. D. Increase the frequency of database backups only.
Correct answer
4. Management claims that no fraud has occurred because no incident has been reported. What is the auditor's BEST response?
A. Accept the claim as sufficient evidence. B. Explain that the absence of reported incidents does not establish that the control is effective. C. Report confirmed fraud immediately. D. Stop testing because management has accepted the risk.
Correct answer:
5. Which additional evidence would be MOST useful in evaluating whether the risk has resulted in unauthorized activity?
A. The administrators' performance appraisals. B. Independently protected logs, transaction-change histories, and relevant database records. C. The bank's employee handbook. D. The IT department's annual training calendar.
Correct answer:
Case Study 2: Audit Sampling and Control Deviations
Questions 6–10
An IS auditor is testing whether changes to a financial application were properly authorized. The population contains 2,400 production changes made during the year. The auditor selects a sample of 60 changes.
Testing identifies six changes without evidence of required approval. Management explains that the changes were urgent and that all six were technically successful. The organization has a formal change management policy requiring authorization and testing.
6. What should the auditor do NEXT?
A. Conclude that all 2,400 changes were unauthorized. B. Ignore the deviations because the changes were successful. C. Investigate the deviations, determine whether an authorized emergency process applied, and assess the implications for control effectiveness. D. Replace the six exceptions with six compliant changes.
Correct answer:
7. Which conclusion is MOST appropriate based on the sample alone?
A. The control is definitely effective across the population. B. The control has no deviations outside the sample. C. The observed deviations raise concern about control effectiveness and may require further evaluation. D. The company has committed fraud.
Correct answer
8. Management provides a spreadsheet claiming that the six changes were approved verbally. What should the auditor do?
A. Accept the spreadsheet without verification. B. Validate the spreadsheet's completeness and accuracy and seek corroborating evidence of authorization. C. Discard the original sample. D. Reclassify the exceptions as compliant based solely on management's statement.
Correct answer:
9. Which factor is MOST relevant when deciding whether to expand testing?
A. The number of pages in the change policy. B. The nature and significance of deviations, their cause, and the auditor's revised assessment of control risk. C. The age of the audit team. D. The software vendor's marketing reputation.
Correct answer:.
10. If the auditor is using statistical sampling, what does sampling risk mean?
A. The risk that every selected item contains an error. B. The risk that a sample-based conclusion differs from the conclusion that would be reached by testing the entire population. C. The risk that the organization uses outdated software. D. The risk that management disagrees with the auditor.
Correct answer:
Case Study 3: Cloud Outsourcing and Audit Evidence
Questions 11–15
A healthcare company outsources its customer database to a cloud service provider. The contract states that the provider is responsible for infrastructure security. The healthcare company remains responsible for protecting customer information and complying with applicable requirements.
During the audit:
- The provider supplies an independent assurance report.
- The report covers general infrastructure controls but excludes certain customer-specific access configurations.
- The company has not independently reviewed privileged access to its own cloud environment.
- Management argues that the provider's assurance report proves the entire environment is secure.
11. What is the auditor's PRIMARY concern?
A. The cloud provider uses external auditors. B. Customer-specific control responsibilities may not be adequately addressed by the provider's assurance report. C. Cloud services always have higher risk than on-premises systems. D. The contract contains too many pages.
Correct answer
12. What should the auditor do FIRST when evaluating the assurance report?
A. Accept it because it was issued independently. B. Examine its scope, reporting period, control objectives, exceptions, and relevant complementary user-entity controls. C. Reject it because the provider is a third party. D. Ask the provider to guarantee that no incidents have occurred.
Correct answer:.
13. Which procedure BEST addresses the missing customer-specific access review?
A. Review the company's actual cloud permissions and compare privileged access with approved business requirements. B. Inspect the provider's office premises. C. Review the company's advertising expenditure. D. Confirm that the provider has a large IT department.
Correct answer
14. The provider refuses direct access to detailed security logs. What is the BEST audit response?
A. Immediately conclude that the provider is noncompliant. B. Assess alternative evidence, contractual audit rights, independent assurance, and whether the evidence available is sufficient for the audit objective. C. Assume that all logs are accurate. D. Stop the entire audit without evaluating alternatives.
Correct answer:
15. Which statement about outsourced IT controls is MOST accurate?
A. Outsourcing transfers every accountability to the provider. B. The customer remains responsible for managing risks associated with its outsourced services and its own control responsibilities. C. The customer no longer needs an internal audit function. D. An independent provider report eliminates the need for ongoing monitoring.
Correct answer
Case Study 4: Business Continuity and Disaster Recovery
Questions 16–20
A financial services company operates a payment-processing platform. Management has approved the following recovery targets:
- Recovery Time Objective (RTO): 2 hours
- Recovery Point Objective (RPO): 15 minutes
The company backs up its database every four hours. Its disaster recovery plan was last tested 18 months ago. The IT director states that the company can recover quickly because it has purchased a secondary server.
16. What is the auditor's GREATEST concern?
A. The company has purchased a secondary server. B. The backup frequency may not meet the approved RPO, and recovery capability has not been recently demonstrated. C. The IT director has not purchased additional office computers. D. The company has documented its recovery objectives.
Correct answer:
17. What should the auditor review FIRST to assess whether the recovery objectives are appropriate?
A. The number of IT staff on the payroll. B. The business impact analysis and approved recovery requirements. C. The secondary server's purchase invoice only. D. The organization's marketing plan.
Correct answer:
18. Which test would provide the BEST evidence that the RTO can be achieved?
A. A written statement from the IT director. B. A documented recovery exercise measuring actual restoration time against the two-hour target. C. A photograph of the secondary server. D. A review of the original server purchase order.
Correct answer
19. Suppose the company restores service within 90 minutes, but the recovered database is missing the last 45 minutes of transactions. Which conclusion is correct?
A. Both objectives have been met. B. The RTO has been met, but the RPO has not been met. C. The RPO has been met, but the RTO has not been met. D. Neither objective can be evaluated.
Correct answer:
20. Management says that recovery testing is too expensive. What is the auditor's BEST response?
A. Accept the decision because testing costs money. B. Evaluate the risk of untested recovery capability and communicate the exposure and need for proportionate validation to the appropriate management level. C. Implement the recovery plan without management authorization. D. Close the finding because the secondary server exists.
Correct answer: risk governance and escalation.
Case Study 5: Application Controls and Data Integrity
Questions 21–25
An e-commerce company processes thousands of refunds each day. Its application checks that a refund relates to an existing order. However, the application does not check whether the same refund request has already been processed.
An auditor discovers multiple refunds against the same order. The finance manager says that the accounting team performs a monthly reconciliation, but no one investigates exceptions until quarter-end.
21. What is the PRIMARY control weakness?
A. The application checks that an order exists. B. The application lacks an effective duplicate-refund prevention or detection mechanism. C. The accounting team performs reconciliations. D. The company processes thousands of transactions.
Correct answer
22. Which control would BEST prevent duplicate refunds at the point of processing?
A. A unique refund transaction identifier with appropriate duplicate detection and idempotency controls. B. A quarterly employee satisfaction survey. C. An increase in the number of finance employees. D. A monthly review of marketing campaigns.
Correct answer:
23. What is the auditor's BEST next step after discovering multiple refunds?
A. Assume all refunds are fraudulent. B. Analyze the affected transactions, validate the evidence, determine the cause, and assess the financial and control impact. C. Delete the duplicate transactions from the audit sample. D. Recommend dismissing the finance manager immediately
Correct answer
24. Why is the monthly reconciliation insufficient as the sole control in this case?
A. Reconciliation is always ineffective. B. Delayed exception investigation may allow duplicate refunds to accumulate and remain unresolved for an extended period. C. Reconciliations cannot detect financial errors. D. Monthly controls are prohibited for all financial systems.
Correct answer:
25. Which combination provides the STRONGEST control approach?
A. Preventive duplicate checks, timely exception monitoring, and independent reconciliation. B. A policy statement without system controls. C. A reconciliation performed only when fraud is reported. D. Reliance on the honesty of employees
Correct answer
Advanced CISA exam traps to remember
These distinctions frequently determine the best answer in scenario-based questions.
Situation | Best audit approach |
Management provides an explanation | Corroborate it with reliable evidence |
An exception is discovered | Investigate its cause and significance |
A control policy exists | Test whether the control actually operates |
A third-party assurance report exists | Evaluate scope, period, exceptions, and complementary controls |
A critical risk remains unresolved | Escalate through appropriate governance channels |
Backup jobs succeed | Verify that data can actually be restored |
An audit sample contains deviations | Reassess control risk and consider additional testing |
A scanner reports a critical vulnerability | Validate the finding and assess exposure and urgency |
Management accepts a risk | Evaluate whether the acceptance is appropriate and properly authorized |
Evidence is insufficient | Obtain more evidence or communicate the limitation |
Self-assessment score
How well did you perform on these 25 advanced questions?
22–25 correct — Strong understanding
18–21 correct — Good, but revise difficult scenarios
13–17 correct — More case-based practice needed
0–12 correct — Revisit core Domain 1 concepts
