CISA Domain 2B-4 Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B-4 (Quality Assurance and Quality Management of IT) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2B-4 Quality Assurance and Quality Management of IT Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a government agency's IT quality assurance function, the IS auditor observes that QA analysts report directly to the development managers whose deliverables they inspect. Project deadlines routinely override quality gate sign-offs, and no exceptions are escalated to an independent authority. Which of the following findings is MOST significant to the IS auditor?

A. QA analysts do not hold a recognized professional quality certification B. The QA function lacks organizational independence from the work it reviews C. Quality gate acceptance criteria are not documented in the QA manual D. QA quality metrics are not benchmarked against comparable public-sector peers

Question 2

A manufacturing company's IT department maintains both a quality assurance program and separate quality control activities. Management asks the IS auditor to confirm that the two responsibilities are correctly separated within the software delivery function. Which of the following activities is MOST appropriately classified as quality assurance rather than quality control?

A. Defining and continuously improving the standardized development process to prevent defects B. Executing documented test cases against a completed application build before release C. Inspecting a batch of processed transactions to detect and correct output errors D. Reviewing production output logs to identify processing exceptions after each run

Question 3

An enterprise claims that its IT organization operates a certified quality management system aligned with ISO 9001. The IS auditor is asked to verify that the QMS is functioning as intended, not merely certified on paper. Which of the following provides the BEST evidence of an effective quality management system?

A. A current ISO 9001 certificate issued by an accredited external registrar B. The published quality policy formally signed by executive management C. Records showing nonconformities are logged, investigated, and corrective actions verified as effective D. Attendance sheets from quality awareness sessions delivered to IT staff

Question 4

A financial services firm's IT quality management program reports a single measure: the number of defects found during testing each quarter. The count has declined steadily, which management presents to the board as proof of improving software quality. Which of the following is the IS auditor's BEST conclusion regarding this reporting?

A. The declining defect count confirms that software quality is genuinely improving B. Defect counts are irrelevant to quality and should be removed from board reporting C. The measure should be replaced with total lines of code delivered per quarter D. A single lagging metric may not reflect quality and could mask reduced testing coverage

Question 5

An IS auditor evaluates the maturity of a software provider's quality management processes. The organization performs quality activities, but only reactively, with practices varying by individual project team and no consistent measurement or defined standard process. Which characterization of the organization's process maturity is MOST appropriate?

A. Processes are optimized, with continuous data-driven improvement embedded throughout B. Processes are quantitatively managed using statistical measures across all projects C. Processes are ad hoc and inconsistent, depending heavily on individual effort D. Processes are fully standardized and consistently enforced across the organization

Question 6

During a post-implementation review at a healthcare provider, the IS auditor finds that the new clinical system passed all functional tests but bypassed the planned quality assurance review before go-live because of schedule pressure. No compensating review was performed. Which of the following is the auditor's BEST course of action?

A. Report that quality assurance controls were not consistently applied, weakening assurance over the deliverable B. Conclude that the system is acceptable because functional testing was completed C. Recommend cancelling the system and reverting to the legacy clinical platform D. Note the observation but treat it as insignificant given the delivery deadline

Question 7

A telecommunications company's IT quality program logs recurring production incidents but closes each one by restoring service, without analyzing the underlying causes. As a result, the same defects reappear across successive releases. Which recommendation should the IS auditor consider MOST appropriate to strengthen the quality management process?

A. Increase the frequency of quality status reports issued to senior management B. Add additional testers to the release team to detect more defects earlier C. Implement root cause analysis with verified corrective actions to prevent recurrence D. Escalate every recurring incident to executive management for individual disposition regardless of severity

Question 8

An IS auditor reviews an insurance company's IT quality management system and finds detailed, well-written procedures, but no evidence that senior management reviews quality performance results or allocates resources toward the stated quality objectives during the period under review. Which of the following findings is MOST significant to the IS auditor?

A. The procedures are not formatted according to the corporate documentation standard B. Management commitment to and oversight of the quality system is not demonstrated C. Quality procedures have not been translated for the company's offshore teams D. The quality manual has not been reviewed within the past twelve months and lacks a documented version history table

Question 9

A logistics firm states that its IT function follows a formal continuous improvement program for quality. To assess whether the improvement is real rather than nominal, the IS auditor gathers supporting information. Which of the following would provide the BEST evidence that the program is effective?

A. A documented continuous improvement policy formally approved by the CIO B. Trend data showing quality objectives are measured and actions produced results C. A published schedule of planned improvement workshops for the coming year D. Interview responses in which staff express general satisfaction with the direction of ongoing quality initiatives and management support

Question 10

A retail bank outsources application development to a third-party vendor and relies entirely on the vendor's internal quality assurance function. The IS auditor must assess assurance over the quality of the delivered software. Which of the following is the BEST approach for the IS auditor to take?

A. Accept the vendor's ISO certification as sufficient assurance of delivered quality B. Review the vendor's QA reports and independently test a sample of delivered software against quality requirements C. Rely on the absence of user complaints since go-live as evidence of quality D. Require the bank to bring all development in-house to control quality directly and eliminate reliance on the external vendor's processes

Related Posts

Leave a Comment Cancel Reply