CISA Domain 1B-3 Practice Test 001

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-3 (Audit Evidence Collection Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-3 Audit Evidence Collection Techniques Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor at a healthcare organization is gathering evidence to support conclusions about the effectiveness of patient-record access controls. Several sources are available, including verbal statements from IT staff, screenshots supplied by the administrator, and access logs the auditor extracts directly. Which source provides the MOST reliable audit evidence?

A. Verbal confirmations obtained from IT operations personnel B. Screenshots of configuration settings provided by the administrator C. System-generated access logs extracted directly by the auditor D. A summary memo prepared and signed by the system administrator

Question 2

During a financial institution's audit of its loan-approval workflow, an IS auditor must confirm that segregation of duties operates as designed. The auditor is choosing among several techniques to validate the control's actual operation. Which approach provides the BEST evidence that the control is functioning effectively?

A. Reperforming a sample of loan transactions to confirm approvals occurred B. Interviewing the loan officers about their assigned processing duties C. Reviewing the documented segregation-of-duties policy for the workflow D. Obtaining management's written assertion that incompatible duties remain separated

Question 3

While collecting evidence during an ERP audit, an IS auditor finds that interview responses about change-approval practices conflict with entries recorded in the system's change log. The discrepancy could indicate a control weakness or an incomplete log. What should the IS auditor do FIRST?

A. Report the conflict immediately as a confirmed control deficiency B. Corroborate the findings using additional independent evidence C. Accept the system change log as the inherently more reliable source D. Disregard the interview responses as unreliable testimony

Question 4

An IS auditor testing a payroll application's authorization controls has examined one processed transaction and confirmed it was properly approved. The auditor is preparing to conclude that the control operated effectively across the entire period under review. Which concern about this evidence is MOST significant?

A. The evidence was not obtained from a source independent of management B. The evidence lacks proper documentation of its original source C. The evidence is irrelevant to the stated control objective D. The evidence is not sufficient to support a conclusion about the full period

Question 5

A government agency's IS auditor is verifying balances processed through an outsourced payment platform. Internal reports produced by the agency show the amounts as reconciled and complete. To strengthen assurance over the reported figures, which additional evidence would be MOST appropriate for the auditor to obtain?

A. External confirmation obtained directly from the third-party payment provider B. A second internal report produced independently by the agency's finance department C. Verbal assurance provided by the agency's reconciliation team D. The agency's documented reconciliation procedure manual

Question 6

During a data center audit, an IS auditor personally observes that badge access to the server room is enforced on the day of the site visit. The auditor intends to conclude that physical access controls operated effectively throughout the entire year. Which limitation of this evidence is MOST significant?

A. Observation is generally considered far less reliable than corroborated management inquiry B. Observation confirms control operation only at the point in time observed C. Observation cannot be recorded within the audit workpapers D. Observation always requires third-party corroboration to be valid

Question 7

An IS auditor reviewing an enterprise's backup operations receives a verbal statement from operations staff that daily backups complete successfully without errors. Before drawing a conclusion, the auditor wants to substantiate this claim with more reliable evidence. Which action would BEST corroborate the staff's statement?

A. Obtain a signed memo from the operations manager confirming the backups B. Request a repeat verbal confirmation from a second operations employee C. Examine system-generated backup completion logs for the period D. Review the organization's documented backup schedule policy

Question 8

During an audit prompted by suspected unauthorized transactions, an IS auditor collects electronic records that may later support disciplinary or legal action by management. Preserving the evidentiary value of these records is critical. Which practice is MOST important to maintain the integrity and reliability of the collected evidence?

A. Maintaining a documented chain of custody for all collected evidence B. Storing the collected evidence on the auditor's personal workstation C. Summarizing the evidence in the audit report immediately after collection D. Sharing the collected evidence with the affected process owners for their validation

Question 9

An IS auditor is evaluating whether terminated employees' system access is revoked promptly. So far the auditor has only interviewed HR and IT personnel, who both confirm that the deprovisioning process operates as intended. Which conclusion about the sufficiency of this evidence is MOST appropriate?

A. Inquiry is regarded as the most reliable evidence for access-revocation controls B. Inquiry obtained from two separate functions is sufficient to conclude on the control C. Inquiry removes the need to inspect the actual deprovisioning records directly D. Inquiry alone is weak evidence and should be corroborated with independent testing

Question 10

While concluding on a firewall configuration control, an IS auditor is prioritizing which forms of evidence to rely on. The available options include management inquiry, direct observation, inspection of change records, and auditor reperformance. Which type generally provides the STRONGEST assurance that the control operates effectively?

A. Reperformance of the control performed by the IS auditor B. Inquiry of the personnel who manage the firewall rules C. Direct observation of the administrator during the site visit D. Inspection of the firewall change-request records

Related Posts

Leave a Comment Cancel Reply