CISA Information System Auditing Process Practice Questions
Information System Auditing Process makes up 9 of every 50 questions on a Tigertest CISA practice test. Here are 10 of the 36 questions on it, each with the answer and the reason.
Updated by the Tigertest team. Based on ISACA's CISA job practice areas (effective August 2024). Original questions; 50 per test, weighted like the real exam. Not affiliated with ISACA.
1. What is the main purpose of an IS audit charter?
- A.To record management's response to findings
- B.To define audit's authority and scope
- C.To list the year's planned audit engagements
- D.To describe the testing steps for each audit
Answer: B. The charter is the mandate: it states the purpose, authority, responsibility and accountability of the audit function. The annual plan, not the charter, lists the engagements.
2. Who should approve the internal IS audit charter?
- A.The head of the IS audit function
- B.The external auditor
- C.The chief information officer
- D.The board or its audit committee
Answer: D. Approval by the board or audit committee gives the audit function its authority and protects its independence from the management it audits.
3. What should drive the selection of areas for an annual IS audit plan?
- A.A risk assessment of auditable areas
- B.The areas cheapest to audit
- C.The order used in last year's audit plan
- D.Requests from IT operations staff
Answer: A. A risk-based plan puts limited audit hours where the risk to business objectives is greatest, then revisits the ranking as risks change.
4. An IS auditor helped design a payroll system's controls last year and is now asked to audit it. What is the best course of action?
- A.Audit it, but skip the payroll controls
- B.Ask the developers to review the work
- C.Disclose the conflict and step aside
- D.Audit it, since the design is well known
Answer: C. Auditing one's own design work impairs independence in fact and in appearance. The auditor should disclose it so the audit can be reassigned.
5. During fieldwork an IS auditor finds signs that a manager may be committing fraud. What should the auditor do first?
- A.Expand testing to prove the fraud
- B.Notify the police straight away
- C.Report it to the right level of management
- D.Question the manager about the suspect entries
Answer: C. Standards call for prompt communication of suspected fraud to an appropriate level of management or those charged with governance, usually above the person suspected. Investigating alone can tip off the suspect and damage evidence.
6. An IS auditor needs evidence that password length rules are enforced on a server. Which source is most reliable?
- A.Settings the auditor views on the server
- B.The administrator's verbal account
- C.The password policy document itself
- D.A screenshot sent by the administrator
Answer: A. Evidence the auditor obtains directly is more reliable than evidence relayed by the auditee, and a policy shows only what should happen, not what is configured.
7. A month-end reconciliation that flags differences between two ledgers after posting is which type of control?
- A.Directive
- B.Preventive
- C.Deterrent
- D.Detective
Answer: D. The reconciliation finds errors after they occur, so it is detective. A preventive control, such as an input edit, would stop the error from being posted.
8. In a small IT department one person both develops and deploys code. Which compensating control is most effective?
- A.A signed acceptable use policy
- B.Supervisor review of deployment logs
- C.Annual secure coding training for the developer
- D.A stronger password for that person
Answer: B. When duties cannot be separated, a detective control performed by someone else, such as a supervisor reviewing what was moved to production, reduces the risk of unauthorized changes.
9. An IS auditor expects almost no exceptions and wants to find at least one if any exist, as in a fraud review. Which sampling method fits best?
- A.Monetary unit sampling
- B.Discovery sampling
- C.Stratified variable sampling
- D.Haphazard sampling
Answer: B. Discovery sampling is a form of attribute sampling used when the expected deviation rate is very low; it sizes the sample to give a set chance of finding one occurrence.
10. Which sampling approach lets an auditor end testing early when the first results show very few deviations?
- A.Cluster sampling
- B.Systematic sampling
- C.Judgmental sampling
- D.Stop-or-go sampling
Answer: D. Stop-or-go (sequential) sampling tests in stages and allows the auditor to stop once results support a conclusion, avoiding oversampling when few errors appear.
Practice all 36 information system auditing process questions, and the rest of the 200-question bank, in the free CISA training sets. Questions you miss come back until you have mastered them.
Start practicingFree to start. No account needed.