It Audit Exam Questions PDF
It Audit Exam Questions PDF
Justification:
A. The business process to be audited cannot be identified until the audit objective has been determined.
B. The risk-based approach requires the IS auditor to first understand the entity and its environment in order to identify
risk. The risk assessment cannot be performed until the audit objective is determined.
C. The IS auditor should develop an audit plan that takes into consideration the objectives of the auditee
relevant to the audit area and its technology infrastructure.
D. Audit resources needed for the audit can only be determined after the scope of the audit has been set.
AS1-2 What is the MAJOR benefit of conducting a control self-assessment (CSA) over a traditional audit?
Justification:
A. CSAs require employees to assess the control stature of their own function. CSAs help increase the
understanding of business risk and internal controls. Because they are conducted more frequently than audits,
CSAs help identify risk in a more timely manner.
B. CSAs do not replace the audit function; an audit must still be performed to ensure that controls are present.
C. CSAs may not reduce the audit function’s workload and are not a major difference between the two approaches.
D. CSAs do not affect the need for audit resources. While the results of the CSA may serve as a reference point for the
audit process, they do not affect the scope or depth of audit work that needs to be performed.
AS1-3 An IS auditor is reviewing a project risk assessment and notices that the overall risk level is high due to
confidentiality requirements. Which of the following types of risk is normally high due to the number of users and business
areas the project may affect?
A. Control risk
B. Compliance risk
C. Inherent risk
D. Residual risk
Page 2 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
Justification:
A. Control risk can be high, but it would be due to internal controls not being identified, evaluated or tested, and would not
be due to the number of users or business areas affected.
B. Compliance risk is the penalty applied to current and future earnings for nonconformance to laws and regulations, and
may not be impacted by the number of users and business areas affected.
C. Inherent risk is normally high due to the number of users and business areas that may be affected. Inherent
risk is the risk level or exposure without taking into account the actions that management has taken or might
take.
D. Residual risk is the remaining risk after management has implemented a risk response, and is not based on the number
of user or business areas affected.
AS1-4 An IS auditor discovers a potential material finding. The BEST course of action is to:
Justification:
A. The item should be confirmed through additional testing before it is reported to management.
B. The item should be confirmed through additional testing before it is discussed with the audit committee.
C. Additional testing to confirm the potential finding should be within the scope of the engagement.
D. The IS auditor should perform additional testing to ensure that it is a finding. An auditor can lose credibility if
it is later discovered that the finding was not justified.
AS1-5 Which of the following is in the BEST position to approve changes to the audit charter?
A. Board of directors
B. Audit committee
C. Executive management
Justification:
A. The board of directors does not need to approve the charter; it is best presented to the audit committee for approval.
B. The audit committee is a subgroup of the board of directors. The audit department should report to the audit
committee and the audit charter should be approved by the committee.
C. Executive management is not required to approve the audit charter. The audit committee is in the best position to
approve the charter.
D. While the director of internal audit may draft the charter and make changes, the audit committee should have the final
approval of the charter.
Page 3 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
AS1-6 An IS auditor reviewing the process to monitor access logs wishes to evaluate the manual log review process.
Which of the following audit techniques would the auditor MOST likely employ to fulfill this purpose?
A. Inspection
B. Inquiry
C. Walk-through
D. Reperformance
Justification:
A. Inspection is just one component of a walk-through and by itself does not supply enough information to provide a full
understanding of the overall process and identify potential control weaknesses.
B. Inquiry provides only general information on how the control is executed. It does not necessarily enable the IS auditor to
determine whether the control performer has an in-depth understanding of the control.
D. Reperformance of the control is carried out by the IS auditor and does not provide assurance of the competency of the
auditee.
AS1-7 An IS auditor is evaluating processes put in place by management at a storage location containing computer
equipment. One of the test procedures compares the equipment on location with the inventory records. This type of testing
procedure executed by the IS auditor is an example of:
A. substantive testing.
B. compliance testing.
C. analytical testing.
D. control testing.
Justification:
A. Substantive testing obtains audit evidence on the completeness, accuracy or existence of activities or
transactions during the audit period.
B. Compliance testing is evidence gathering for the purpose of testing an enterprise’s compliance with control procedures.
This differs from substantive testing in which evidence is gathered to evaluate the integrity of individual transactions, data
or other information.
C. Analytical testing evaluates the relationship of two sets of data and discerns inconsistencies in the relationship.
A. An impact
B. A vulnerability
C. An asset
Page 4 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
D. A threat
Justification:
A. Impact is the measure of the financial loss that a threat event may have.
B. The lack of adequate controls represents a vulnerability, exposing sensitive information and data to the risk
of malicious damage, attack or unauthorized access by hackers. This could result in a loss of sensitive
information, financial loss, legal penalties or other losses.
C. An asset is something of either tangible or intangible value worth protecting, including people, systems, infrastructure,
finances and reputation.
AS1-9 An IS auditor is evaluating the controls around provisioning visitor access cards to the organization’s IT facility. The
IS auditor notes that daily reconciliation of visitor card inventory is not carried out as mandated. However, an inventory
count carried out by the IS auditor reveals no missing access cards. In this context, the IS auditor should:
Justification:
A. Absence of discrepancy in physical count only confirms absence of any impact, but cannot be a reason to overlook
failure of operation of the control.
B. While the IS auditor may in some cases recommend a change in procedures, the primary goal is to observe and report
when the current process is deficient.
C. The IS auditor should report the lack of daily reconciliation as an exception because a physical inventory
count gives assurance only at a point in time and is not a management-mandated activity.
D. While the IS auditor may in some cases recommend a solution, the primary goal is to observe and report when the
current process is deficient.
AS1-10 During an audit, the IS auditor notes that the application developer also performs quality assurance testing on a
particular application. Which of the following should the IS auditor do?
Justification:
A. While compensating controls may be a good idea, the primary response in this case should be to report the condition.
B. Evaluating the code created by the application developer is not the appropriate response in this case. The IS auditor
may evaluate a sample of changes to determine whether the developer tested his/her own code, but the primary response
Page 5 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
C. Analyzing the quality assurance dashboards can help evaluate the actual impact of the lack of segregation of duties, but
does not address the underlying risk. The primary response should be to report the condition.
D. The software quality assurance role should be independent and separate from development and
development activities. The same person should not hold both roles because this would cause a segregation of
duties concern. The IS auditor should report this condition when identified.
AS1-11 An IS auditor is reviewing risk and controls of a bank wire transfer system. To ensure that the bank’s financial risk
is properly addressed, the IS auditor will most likely review which of the following?
Justification:
A. Privileged access, such as administrator access, is necessary to manage user account privileges and should not be
granted to end users. The wire transfer procedures are a better control to review to ensure that there is segregation of
duties of the end users to help prevent fraud.
B. Wire transfer procedures include segregation of duties controls. This helps prevent internal fraud by not
allowing one person to initiate, approve and send a wire. Therefore, the IS auditor should review the
procedures as they relate to the wire system.
C. Fraud monitoring is a detective control and does not prevent financial loss. Segregation of duties is a preventive control.
D. While controls related to background checks are important, the controls related to segregation of duties as found in the
wire transfer procedures are more critical.
AS1-12 An IS auditor is determining the appropriate sample size for testing the existence of program change approvals.
Previous audits did not indicate any exceptions, and management has confirmed that no exceptions have been reported for
the review period. In this context, the IS auditor can adopt a:
Justification:
A. When internal controls are strong, a lower confidence coefficient can be adopted, which will enable the use
of a smaller sample size.
B. A higher confidence coefficient will result in the use of a larger sample size.
C. A higher confidence coefficient need not be adopted in this situation because internal controls are strong.
D. A lower confidence coefficient will result in the use of a smaller sample size.
AS1-13 Why does an audit manager review audit papers from an IS auditor, even when the auditor has more than
10 years of experience?
Page 6 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
Justification:
A. Internal quality requirements may exist, but are superseded by the requirement of supervision to comply with
professional standards.
B. Audit guidelines exist to provide guidance on how to achieve compliance with professional standards. For example, they
may provide insights on the purpose of supervision and examples of how supervisory duties are to be performed to achieve
compliance with professional standards.
C. An audit methodology is a well-configured process/procedure to achieve audit objectives. While an audit methodology is
a meaningful tool, supervision is generally driven by compliance with professional standards.
D. Professional standards from ISACA, The Institute of Internal Auditors (IIA) and the International Federation of
Accountants (IFAC) require supervision of audit staff to accomplish audit objectives and comply with
competence, professional proficiency and documentation requirements, and more.
AS1-14 Which of the following is the PRIMARY reason IS auditors conduct risk assessments?
Justification:
A. Risk assessments form the basis of audit department management and are used to determine potential
areas on which to focus audit efforts and resources. A risk assessment is the process used to identify and
evaluate risk and its potential effects.
B. Updating the risk register is the responsibility of operations management, not the IT audit department.
C. Management chooses the correct risk response strategy based on the enterprisewide risk assessment, evaluation and
analysis.
D. Assurance on risk management is not the main reason why risk assessments are performed by the audit department.
The IT department performs risk assessments for two purposes: to create a risk-based audit schedule and to manage the
risk related to each audit engagement from a delivery and project management perspective.
AS2-1 An IS auditor is reviewing the disaster recovery plan (DRP) for a large organization with multiple locations requiring
high systems availability. Which of the following causes the GREATEST concern?
Page 7 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
D. A physical copy of the plan is not available at the alternate processing site.
Justification:
A. While an agreement for an alternate processing site is important, a large organization with multiple locations will most
likely have other alternate processing sites within the organization without needing a third-party processing center. Data
could be sent to another site within the organization, but if the backup data are not reliable, the risk to availability is not
managed.
B. Testing backups provides assurance that the backup data are reliable and will be available when needed.
Without backup data, the organization is not addressing the risk of availability.
C. While it is important to periodically test the DRP, it is also effective to periodically test the plan using certain scenarios
instead of testing the entire plan. In many cases the restoration of backup media will not change for different disasters. For
organizations with high availability requirements, data must be reliable and available when needed. If the primary
processing center is not available, recovery of backup media is typically the same for each location as long as it is reliable
and available.
D. The DRP must be available to all personnel involved with recovery efforts. With the availability of the Internet, there are
alternative methods of delivery/retrieval of the plan. Reliability and availability of backup data are priorities for organizations
that require high availability.
AS2-2 An IS auditor reviewing a project’s risk and related risk responses would be MOST concerned with a lack of
management sign-off for a risk that was:
A. avoided.
B. transferred.
C. mitigated.
D. accepted.
Justification:
A. The avoidance strategy involves not implementing certain activities or processes that incur risk, thus eliminating the risk.
The IS auditor would not expect a formal sign-off for an avoided risk.
B. Risk that is transferred is shared among partners such as through insurance or contractual agreement. Lack of a
documented management sign-off would be of concern, but not as high a concern as with an accepted risk because the
overall risk to the organization is reduced.
C. Because the risk has been mitigated, management has signed off and approved the approach used to mitgate the risk.
The IS auditor would be more concerned if management did not approve a risk that was accepted.
D. In order to accept the risk, management must first be made aware of the risk and its consequences. This
includes a formal acceptance of the risk, which is usually evidenced by a sign-off.
AS2-3 For key performance indicators (KPIs) to be an effective and useful metric, it is MOST important that:
Page 8 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
Justification:
A. Measurement at consistent intervals is not likely to be important because trends and the extent to which goals are
achieved can be determined.
B. The most important metric is the extent to which the key goal indicators (KGIs) are achieved.
C. CSFs are important considerations for determining that a goal is being achieved, but are not a metric.
D. Quantitative measures are usually preferable, but not always possible and not essential.
AS2-4 Which of the following documents is the BEST source for an IS auditor to understand the requirements for
employee awareness training?
Justification:
A. The information security policy states the organization’s approach to managing information security. The
policy contains the company’s security objectives and explains the security policies, principles and standards.
In addition, the policy outlines requirements such as compliance with regulations and employee education,
training and awareness.
B. The acceptable usage policy outlines guidelines and rules for employee use of the company’s information resources. It
is focused and does not include requirements for security awareness training.
C. The HR policy refers to the information security policy, but does not specifically list the requirements for security
awareness training. Instead, this document contains broader information such as hiring practices, commitments to diversity
and ethics, and compliance with regulations.
D. The end-user computing policy describes the parameters and usage of desktop tools by users. It does not contain
requirements for security awareness training.
Justification:
A. Elements of unacceptable risk will require treatment, but all activities are subject to risk management oversight.
Assessing risk and determining which risk is acceptable and which risk has the potential for impact are functions of risk
management.
B. Risk management must be holistic and should not be limited to areas that exceed acceptable risk levels. Areas within
acceptable risk levels may be optimized by reducing control measures or assuming more risk.
C. While not all organizational activities will pose an unacceptable risk, the practice of risk management is still
applied to determine which risk requires treatment.
Page 9 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
D. When assessing risk, determining which risk is acceptable, which risk exceeds acceptable levels and which risk has the
potential for impact are functions of risk management.
A. enable the alignment of IT risk management with enterprise risk management (ERM).
Justification:
A. Aligning IT risk management with ERM is important to ensure the cost-effectiveness of the overall risk management
process. However, risk analysis does not enable such an alignment.
B. Risk analysis is a process by which the likelihood and magnitude of IT risk scenarios are estimated. Risk
analysis is conducted to ensure that the information assets with the greatest risk likelihood and impact are
managed before addressing risk with a lower likelihood and impact. Prioritization of IT risk helps maximize
return on investment for risk responses.
C. Risk analysis evaluates risk on the basis of likelihood and impact and includes financial, environmental, regulatory and
other risk. It looks at regulatory risk as one type of risk that the organization faces, but is not specifically designed to satisfy
legal and regulatory compliance requirements.
D. Risk analysis occurs after risk identification and evaluation. Risk identification determines known threats and
vulnerabilities. Risk evaluation assesses the risk and creates valid risk scenarios. Risk analysis quantifies risk along the
vectors of likelihood and impact to facilitate the prioritization of risk responses.
Justification:
A. Employee orientations and user awareness training are the most effective processes to raise user awareness about the
acceptable use of proprietary IT resources. The acceptable use policy is one of the topics covered during training and is
often signed after employee orientation and during periodic user awareness training.
B. The acceptable use policy is a subset of the information security policies that focus on the end user and a specific topic.
Information security policies are much broader in overall content and include a wider audience.
C. Although the policy may include a statement regarding the sanctions for noncompliance, sanctions are not the primary
objective of the acceptable use policy; prevention is the primary objective.
D. Inappropriate use of proprietary IT resources by users exposes enterprises to a variety of risk scenarios,
including malware attacks, compromise and unavailability of critical systems, and legal issues. To address such
risk, a policy supported by guidelines is put into effect to define how information system resources will be
used. An acceptable use policy ensures that users are made aware of acceptable usage and the need to
acknowledge that they are aware.
AS2-8 What is the GREATEST risk of a bank outsourcing its data center?
Page 10 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
Justification:
A. The risk of loss or leakage of information is the greatest risk because it can subject the company to
regulatory fines, lawsuits and reputation risk.
B. Although noncompliance with regulations subjects a company to potential fines, it is not necessarily as great a risk as a
security breach.
C. The risk of vendor failure or bankruptcy can be mitigated in the contract through such clauses as code escrow as well
as a robust recovery process. Although this risk is inherent in any contractual relationship, if the correct controls are in
place then it should not materially affect the bank as much as a loss or leakage of information.
D. The risk of a lack of internal IS staff knowledge through outsourcing, although valid, is not as great a risk as that
resulting from a loss or leakage of information. Contractual controls, such as a turnover period in the event of contract
termination, can also help mitigate the risk of loss of internal knowledge.
AS2-9 Which of the following should be of GREATEST concern to an IS auditor reviewing the business continuity plan
(BCP) of an organization?
A. Daily full backups are not performed for critical production files.
B. A team of IT and information security staff conducted the business impact analysis (BIA).
Justification:
A. Daily full backups may not be required if incremental or differential backups are in place.
B. To be effective, the BIA should be conducted with input from a wide array of stakeholders. The business
requirements included within the BIA are integral in defining mean-time-to-repair and the data point recovery.
Without business stakeholder input, these critical requirements may not be correctly defined, leading to critical
assets being overlooked.
C. As long as the service delivery objective is met and data are handled in alignment with the data classification and
handling policy, it is appropriate for “sensitive” functions to be performed manually in the case of a BCP event.
D. The frequency of testing is less important than business involvement in the creation of the BCP.
AS2-10 Which of the following compensating controls should management implement when a segregation of duties conflict
exists because an organization has a small IT department?
Page 11 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
Justification:
A. While frequent review of audit logs is a compensating control, if there is no clear segregation of duties, this is an
ineffective control. An IT person with administrative access to a system could potentially delete audit logs or disable audit
logging altogether. From a practical perspective, logs typically contain large volumes of data; an in-depth review of these
data would be a time-consuming and impractical method for finding issues related to segregation of duties conflicts.
B. User provisioning is the process of granting access to an application or system. While a normal part of the provisioning
process is to make sure that no segregation of duties conflicts exist, this cannot be done in the present case due to the
small size of the IT department. Therefore, tighter controls over user provisioning would be of limited value.
C. While it important to ensure that only authorized individuals have administrative access to critical systems to prevent
segregation of duties conflicts, in this case those conflicts cannot be prevented. Therefore, a frequent review of
administrative access would be of limited value as a control.
D. Assuming that the integrity of the exception reporting process can be validated through audit testing, an
independent review of the exception reports is the best compensating control.
AS2-11 An IS auditor is reviewing the IT governance practices. Which of the following BEST helps the IS auditor evaluate
the quality of alignment between IT and the business?
A. Security policies
B. Operational procedures
C. Project portfolio
Justification:
A. Security policies are important; however, they are not designed to align IT to the business.
B. Operational procedures do not provide the IS auditor assurance of the alignment between IT and the business.
C. The project portfolio is the set of projects owned by the organization. The portfolio provides a status quo, but is not a
good basis to assess alignment of IT with the business.
D. The IT BSC represents the translation of the business objectives into what IT needs to do to achieve these
objectives.
AS2-12 Value delivery from IT to the business is MOST effectively achieved by:
Justification:
A. IT’s value delivery to the business is driven by aligning IT with the enterprise’s strategy.
B. Embedding accountability in the enterprise promotes risk management (another element of corporate governance).
C. While ROI is important, it is not the only criterion by which the value of IT is assessed.
Page 12 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
D. Enterprisewide risk management is critical to IT governance; however, by itself it will not guarantee that IT delivers
value to the business unless the IT strategy is aligned with the enterprise strategy.
AS2-13 Which of the following BEST indicates that a business continuity plan (BCP) will function as intended in the event
of a disaster?
Justification:
A. While recovery plans should be kept current, the use of a tabletop exercise to test the plan is a better option because it
involves people and processes.
B. A tabletop exercise is used to test the effectiveness of a BCP without the interruption of a full-scale drill. The
test team walks through a simulated disaster to determine whether the plan will work as designed. Of the
options given, a tabletop exercise is the best way to ensure that the BCP will function as intended without live
testing to reveal plan deficiencies.
C. Reciprocal agreements will specify the conditions among counterparties for sharing facilities in case of disaster, but
provide no assurance plans that the BCPs will work.
D. Long-haul diversity and last-mile redundancy are important considerations for business continuity planning, but by
themselves are insufficient to ensure that the plans will work.
AS2-14 Which of the following is the BEST indicator of IT alignment with organizational strategies and objectives?
Justification:
A. EA helps define standards and designs for IT systems; however, it does not measure how IT is aligned with the
business.
B. Policy compliance metrics do not indicate IT’s alignment with the business.
C. Business owners are in the best position to provide direct feedback on the extent to which IT provides
support for business objectives and strategies.
D. An internal controls assessment will not provide evidence of IT’s alignment with the business.
AS3-1 An IS auditor is reviewing a monthly accounts payable transaction register using audit software. For what purpose
would the auditor be interested in using a check digit?
Page 13 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
Justification:
A. A check digit is a numeric value added to data to ensure that original data are correct and have not been
altered.
B. Ensuring that data have not exceeded a predetermined amount is a limit check.
C. Ensuring that data entered are within predetermined reasonable limits is a reasonableness check.
D. Ensuring that data entered are within a predetermined range of values is a range check.
AS3-2 Which of the following is the BEST indicator that a newly developed system will be used after it is in production?
A. Regression testing
C. Sociability testing
D. Parallel testing
Justification:
A. Regression test results do not assist with the user experience and are primarily concerned with new functionality or
processes and whether those changes altered or broke previous functionality.
B. UAT is undertaken to provide confidence that a system or system component operates as intended, to
provide a basis for evaluating the implementation of the requirements, or to demonstrate the effectiveness or
efficiency of the system or component. If the results of the testing are poor, then the system is unlikely to be
adopted by the users.
C. Sociability test results indicate how the application works with other components within the environment and is not
indicative of the user experience.
D. Parallel testing is performed when the comparison of two applications is needed, but will not provide feedback on user
satisfaction.
Justification:
A. Day-to-day management and leadership of the project is the function of the project manager.
B. Providing the funding for the project is the function of the project sponsor.
C. The project steering committee provides overall direction; ensures appropriate representation of the major
stakeholders in the project’s outcome; and takes ultimate responsibility for the deliverables, costs and
Page 14 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
timetables.
D. Ensuring that system controls are in place is the function of the project security officer.
AS3-4 Which of the following BEST helps ensure that deviations from the project plan are identified?
Justification:
A. Establishment of a project management framework identifies the scope and boundaries of managing projects and the
consistent method to be applied when initiating a project, but does not define the criteria used to measure project success.
B. A project management approach defines guidelines for project management processes and deliverables, but does not
define the criteria used to measure project success.
C. A project resource plan defines the responsibilities, relationships, authorities and performance criteria of project team
members, but does not wholly define the criteria used to measure project success.
D. In order to identify deviations from the project plan, project performance criteria must be established as a
baseline. Successful completion of the project plan is indicative of project success.
AS3-5 An IS auditor is reviewing a project for the implementation of a mission-critical system and notes that, instead of
parallel implementation, the team opted for an immediate cutover to the new system. Which of the following is the
GREATEST concern?
C. Software functionality tests were completed, but stress testing was not performed.
D. The go-live date is over a holiday weekend when key IT staff are on vacation.
Justification:
A. One of the benefits of deploying a new system in parallel with an existing system is that the original system
can always be used as a backout plan. In an immediate cutover scenario, not having a backout plan can create
significant issues because it can take considerable time and cost to restore operations to the prior state if there
is no viable plan to do so.
B. The documentation of UAT is a much less important concern than not having a viable backout plan; therefore, this is not
the correct answer.
C. The lack of stress testing is a much less important concern than not having a viable backout plan; therefore, this is not
the correct answer.
D. If there are support issues, having the go-live date happen over a holiday weekend may create some delays, but project
managers should account for this to ensure that the required staff are available as needed. The greater risk is if there is no
backout plan.
AS3-6 Which of the following software testing methods provides the BEST feedback on how software will perform in the
live environment?
Page 15 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
A. Alpha testing
B. Regression testing
C. Beta testing
Justification:
A. Alpha testing is often performed only by users within the organization developing the software. Alpha testing generally
involves a software version that does not contain all the features of the final product and may be a simulated test.
B. Regression testing is used to determine whether system changes have introduced new errors to existing functionality.
C. Beta testing follows alpha testing and involves real-world exposure with external user involvement. Beta
testing is the last stage of testing, and involves sending the beta version of the product to independent beta
test sites or offering it free to interested users.
AS3-7 Which of the following is the BEST method of controlling scope creep in a system development project?
Justification:
A. While defining penalties for changes in requirements may help to prevent scope creep, software baselining is a better
way to accomplish this goal.
B. Software baselining, the cutoff point in the design phase, occurs after a rigorous review of user
requirements. Any changes thereafter will undergo strict formal change control and approval procedures.
Scope creep refers to uncontrolled change within a project resulting from improperly managed requirements.
C. In a matrix project organization, management authority is shared between the project manager and the department
heads. Adopting a matrix project management structure will not address the problem of scope creep.
D. Although the critical path is important, it will change over time and will not control scope creep.
AS3-8 Which of the following is a PRIMARY objective of embedding an audit module while developing online application
systems?
Justification:
A. Embedding a module for continuous auditing within an application processing a large number of transactions
Page 16 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
CISA Review Questions, Answers & Explanations Manual 2014 Supplement
provides timely collection of audit evidence during processing and is the primary objective. The continuous
auditing approach allows the IS auditor to monitor system reliability on a continuous basis and to gather
selective audit evidence through the computer.
B. An embedded audit module enhances the effectiveness of internal audit by ensuring timely availability of required
evidence. It may not reduce the requirements for periodic internal audits, but it will increase their efficiency. Also, the
question pertains to the development process for new application systems, and not to subsequent internal audits.
C. An audit module collects data on transactions that may help identify fraudulent transactions, but it does not identify
fraudulent transactions inherently.
D. Although increased efficiency may be an added benefit of an embedded audit module, it is not the primary objective.
Page 17 / 17
Reprinted for isaca\449222, ISACA ISACA (c) 2013, Copying Prohibited.
Practice Questions
□ A. Monitor
□ B. Fac ilitator
□ C. Project leader
2. Which of the following elements must be present to properly log activities and ac hieve
acc ountability for actions performed by a user?
A2: Answer: C. If proper identification and authentic ation are not performed during access
control, no acc ountability can exist for any action performed.
3. When initially planning a risk-based audit, whic h of the following steps is MOST
critical?
A3: Answer: D. In planning an audit, the MOST critical step is identifying areas of high risk.
A4: Answer: C. Although secure audit trails and other logging are used as a c ompensatory
control for a lack of proper segregation of duties, the primary purpose of audit trails is
to establish ac countability and responsibility for processed transac tions.
5. Which of the following is the MOST appropriate type of risk to be associated with
authorized program exits (trap doors)?
□ A. Inherent
□ B. Audit
□ C. Detec tion
□ D. Business
A5: Answer: A. Inherent risk is associated with authorized program exits (trap doors).
6. When performing an audit of an organization’s systems, the auditor’s first step should
be to:
A6: Answer: B. The IS auditor’s first step is to understand the business focus of the
organization. Until the auditor has a good understanding of the organization’s business
goals, objec tives, and operations, the auditor will not be able to competently c omplete
any of the other tasks listed.
7. Which of the following risks results when the auditor uses an insufficient test
procedure, resulting in the auditor’s ill-informed conc lusion that material errors do not
exist, when, in fac t, they do?
□ A. Business risk
□ D. Inherent risk
A7: Answer: B. Detec tion risk results when an IS auditor uses an inadequate test
procedure and conc ludes that material errors do not exist when, in fact, they do.
8. Which of the following is c onsidered the MOST signific ant advantage of implementing a
continuous auditing approac h?
A8: Answer: A. The PRIMARY advantage of a c ontinuous audit approac h is that it can
improve system security when used in time-sharing environments that proc ess a large
number of transactions.
A9: Answer: D. While preparing the audit report, the IS auditor should record the
observations and the risk arising from the c ollective weaknesses.
10. Which of the following is c onsidered to present the GREATEST c hallenge to using test
data for validating processing?
□ A. Potential corruption of actual live data
A10: Answer: B. Creating test data that c overs all possible valid and invalid conditions is
often the greatest challenge in using test data.
CISA Practice Exam Questions D. The auditor is objective, not associated with the
organization, and free of any connections to the client
1. Which type of sampling is best when dealing with
population characteristics such as dollar amounts and 7. Which of the following meets the description “the
weights? primary objective is to leverage the internal audit
A. Attribute sampling function by placing responsibility of control and
B. Variable sampling monitoring onto the functional areas”?
C. Stop-and-go sampling A. Integrated auditing
D. Discovery sampling B. Control self-assessment
C. Automated work papers
2. Which of the following sampling techniques is D. Continuous auditing
generally applied to compliance testing?
A. Attribute sampling 8. Which of the following sampling techniques would
B. Variable sampling be best to use if the expected discovery rate is
C. Stop-and-go sampling extremely low?
D. Discovery sampling A. Attribute sampling
B. Variable sampling
3. To guarantee the confidentiality of client C. Stop-and-go sampling
information, an auditor should do which of the D. Discovery sampling
following when reviewing such information?
A. Contact the CEO or CFO and request what sensitive 9. Which of the following offers how-to information?
information A. Standards
can and cannot be disclosed to authorities B. Policy
B. Assume full responsibility for the audit archive and C. Guidelines
stored data D. Procedures
C. Leave all sensitive information at the owners’
facility 10. The type of risk that might not be detected by a
D. Not back up any of his or her work papers system of internal controls is defined as which of the
following?
4. Which of the following best describes materiality? A. Control risk
A. An audit technique used to evaluate the need to B. Audit risk
perform an auditB. The principle that individuals, C. Detection risk
organizations, and the community are responsible for D. Inherent risk
their actions and might be required to explain them
C. The auditor’s independence and freedom from 11. Which of the following items makes computer-
conflict of interest assisted audit techniques (CAAT) important to an
D. An auditing concept that examines the importance auditor?
of an item of information in regard to the impact or A. A large amount of information is obtained by using
effect on the entity being audited specific techniques to analyze systems.
B. An assistant or untrained professional with no
5. Which of the following sampling technique is best to specialized training can utilize CAAT tools, which frees
use to prevent excessive sampling? up the auditor to participate in other activities.
A. Attribute sampling C. CAAT requires more human involvement in the
B. Variable sampling analysis than multifunction audit utilities.
C. Stop-and-go sampling D. CAAT requires the auditor to reduce the sampling
D. Discovery sampling rate and provides a more narrow audit coverage.
6. Which of the following descriptions best defines 12. The risk that a material error will occur because of
auditor independence? weak controls or no controls is known as which of the
A. The auditor has high regard for the company and following?
holds several hundred shares of the company’s stock A. Control risk
B. The auditor has a history of independence and even B. Audit risk
though the auditor has a niece that is employed by the C. Detection risk
company, he has stated that this is not a concern D. Inherent risk
C. The auditor has previously given advice to the
organization’s design staff while employed as the
auditor
13. You have been asked to audit a series of controls. C. System-development methodologies and change-
Using Figure E.1 as your reference, what type of control control procedures that have been implemented to
have you been asked to examine? protect the organization and maintain compliance
A. Amount total D. Procedures that provide reasonable assurance to
B. Hash total control and manage data-processing operations
C. Item total
D. Data checksum 18. Which of the following is the best example of a
Figure E.1. detective control?
[View full size image] A. Access-control software that uses passwords,
tokens, and/or
biometrics
B. Intrusion-prevention systems
C. Backup procedures used to archive data
D. Variance reports
14. Which of the following is the best tool to extract 20. You have been asked to implement a continuous
data that is relevant to the audit? auditing program. With this in mind, which of the
A. Integrated auditing following should you first identify?
B. Generalized audit software A. Applications with high payback potential
C. Automated work papers B. The format and location of input and output files
D. Continuous auditing C. Areas of high risk within the organization
D. Targets with reasonable thresholds
15. You have been asked to perform an audit of the
disaster-recovery procedures. As part of this process, 21. Which of the following should be the first step for
you must use statistical sampling techniques to organizations wanting to develop an information
inventory all backup tapes. Which of the following security program?
descriptions best defines what you have been asked to A. Upgrade access-control software to a biometric or
do? token system
A. Continuous audit B. Approve a corporate information security policy
B. Integrated audit statement
C. Compliance audit C. Ask internal auditors to perform a comprehensive
D. Substantive audit review
D. Develop a set of information security standards
16. According to ISACA, which of the following is the
fourth step in the risk based audit approach? 22. Which of the following is primarily tasked with
A. Gather information and plan ensuring that the IT department is properly aligned
B. Perform compliance tests with the goals of the business?
C. Perform substantive tests A. Chief executive officer
D. Determine internal controls B. Board of directors
C. IT steering committee
17. Which general control procedure most closely D. Audit committee
maps to the information systems control procedure
that specifies, “Operational controls that are focused 23. The balanced score card differs from historic
on day-to-day activities”? measurement schemes, in that it looks at more than
A. Business continuity and disaster-recovery what?
procedures that provide reasonable assurance that the A. Financial results
organization is secure against disasters B. Customer satisfaction
B. Procedures that provide reasonable assurance for C. Internal process efficiency
the control of database administration D. Innovation capacity
28. Which of the following is the best method to
24. Which of the following is the purpose of enterprise identify problems between procedure and activity?
architecture (EA)? A. Policy review
A. Ensure that internal and external strategy are B. Direct observation
aligned C. Procedure review
B. Map the IT infrastructure of the organization D. Interview
C. Map the IT infrastructure of the organization and
ensure that its 29. You are working with a risk-assessment team that
design maps to the organization’s strategy is having a hard time calculating the potential financial
D. Ensure that business strategy and IT investments loss to the company’s brand name that could result
are aligned from a risk. What should the team do next?
A. Calculate the return on investment (ROI)
25. Which of the following types of planning entails an B. Determine the single loss expectancy (SLE)
outlook of greater than three years? C. Use a qualitative approach
A. Daily planning D. Review actuary tables
B. Long-term planning
C. Operational planning 30. What operation-migration strategy has the highest
D. Strategic planning possible level of risk?
A. Parallel
26. A new IT auditor has been asked to examine some B. Hard
processing, editing, and validation controls. Can you C. Phased
help define the control shown in Figure E.2? D. Intermittent
A. Validity check
B. Reasonableness check 31. Many organizations require employees to rotate to
C. Existence check different positions. Why?
D. Range check A. Help deliver effective and efficient services
Figure E.2. B. Provide effective cross-training
[View full size image] C. Reduce the opportunity for fraud or improper or
illegal acts
D. Increase employee satisfaction
60. Which of the following is an example of a 5GL 66. As a new auditor, you have been asked to review
language? network operations. Which of the following
A. SQL weaknesses should you consider the most serious?
B. Assembly A. Data files can be amended or changed by
C. FORTRAN supervisors.
D. Prolog B. Data files can be lost during power outages because
of poor backup.
61. Which of the following types of network topologies C. Sensitive data files can be read by managers.
is hard to expand, with one break possibly disabling the D. Copies of confidential reports can be printed by
entire segment? anyone.
A. Bus
B. Star 67. Which of the following is the best example of a
C. Token Ring control mechanism to be used to control component
D. Mesh failure or errors?
A. Redundant WAN links
62. What is the most important reason to use plenum- B. Just a Bunch of Disks/Drives (JBOD)
grade cable? C. RAID 0
A. Increased network security D. RAID 1
B. Less attenuation
C. Less cross-talk 68. Which of the following is the best technique for an
D. Fire-retardant coating auditor to verify firewall settings?
A. Interview the network administrator
63. Which of the following copper cable network B. Review the firewall configuration
configurations is considered the most secure from C. Review the firewall log for recent attacks
eavesdropping or interception? D. Review the firewall procedure
A. A switched VLAN using multimode fiber cable
B. A Token Ring network using Cat 5 cabling 69. Which of the following is not a circuit-switching
C. A switched network that uses Cat 5e shielded cable technology?
D. A bus network using 10BASE2 cabling A. DSL
B. POTS
64. Which of the following is an iterative development C. T1
method in which repetitions are referred to as sprints D. ATM
and typically last 30 days?
A. Scrum 70. Which of the following uses a process to
B. Extreme programming standardize code modules to allow for cross-platform
C. RAD operation and program integration?
A. Component-based development (CBD) 77. According to ISACA, the second step in the business
B. Web-based application development (WBAD) continuity planning (BCP) process is which of the
C. Object-oriented systems development (OOSD) following?
D. Data-oriented system development (DOSD) A. Project management and initiation
B. Plan design and development
71. Data warehouses are used to store historic data of C. Recovery strategy
an organization. As such, which of the following is the D. Business impact analysis
most accurate way to describe data warehouses?
A. Subject-oriented 78. You have been asked to review the documentation
B. Object-oriented for a planned database. Which type of database is
C. Access-oriented represented by Figure E.6?
D. Control-oriented A. Relational
B. Network
72. Which of the following access-control models C. Hierarchical
allows the user to control access? D. Floating flat
A. Mandatory access control (MAC) Figure E.6.
B. Discretionary access control (DAC)
C. Role-based access control (RBAC)
D. Access control list (ACL)
83. Which of the following best defines the service 90. You are performing an audit of an organization’s
delivery objective (SDO)? physical security controls, specifically, emergency
A. Defines the maximum amount of time the controls. When doors that use relays or electric locks
organization can provide services at the alternate site are said to fail soft, what does that mean?
B. Defines the level of service provided by alternate A. Locks of this type fail open.
processes B. Locks of this type are easy to pick.
C. Defines the time that systems can be offline before C. Locks of this type fail closed.
causing damage D. Locks of this type are hard to pick.
D. Defines how long the process can take to be
restored 91. Which type of database is represented by Figure
E.7?
84. During which step of the business continuity A. Relational
planning (BCP) process is a risk assessment performed? B. Network
A. Project management and initiation C. Hierarchical
B. Plan design and development D. Floating flat
C. Recovery strategy Figure E.7.
D. Business impact analysis