CISA Domain 1B-4 Practice Test 001

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-4 (Audit Data Analytics) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-4 Audit Data Analytics Practice Test 001

10 questions • Single best answer

Question 1

A commercial bank's internal audit team plans to use generalized audit software to analyze the entire population of wire transfers for the fiscal year rather than relying on a statistical sample. The auditor receives a data extract of transaction records that was prepared and provided by the IT department. Before running any analytics routines against the file, what should the IS auditor do FIRST?

A. Reconcile the extract to source control totals to confirm completeness B. Run duplicate-payment tests across the population to identify potentially fraudulent or erroneous transfers C. Design dashboards and visualizations to present anomalies to the audit committee D. Apply Benford's Law to the transfer amounts to detect statistically unusual leading-digit distributions

Question 2

During an audit of a large retailer's procurement cycle, the audit lead wants controls over purchase orders and receipts to be tested automatically, with exceptions flagged as transactions occur rather than reviewed weeks after period-end. The retailer processes high transaction volumes across many stores each day. Which data analytics approach BEST meets this stated objective?

A. Periodic full-population re-performance of control tests at each quarter-end B. Continuous auditing using embedded routines that test transactions in near real time C. Judgmental sampling of the highest-value purchase orders selected each reporting period D. Retrospective trend analysis comparing this year's purchasing data against prior-year baselines

Question 3

An IS auditor uses data analytics to examine a manufacturer's vendor disbursements and identifies 800 exceptions within a population of 120,000 payments. Management insists the disbursement process is well controlled and that the auditor's logic is flawed. Before documenting the exceptions as audit findings and communicating them to stakeholders, what should the auditor do FIRST?

A. Escalate the full exception count directly to the audit committee for immediate action B. Recommend that management redesign the disbursement control to prevent recurrence of exceptions C. Investigate whether the exceptions reflect genuine control failures or data-quality issues D. Expand the analytics to include disbursement data from the prior three fiscal years

Question 4

An audit team is selecting a testing strategy for a government agency's payroll transactions and has the analytics capability to process every record. During planning, leadership asks the auditor to justify recommending full-population analytics over traditional statistical sampling of the payroll file. Which statement BEST describes the primary advantage of the full-population approach in this situation?

A. It removes any need to validate the completeness of the extracted source data before testing B. It examines every record in the population, so sampling risk is effectively eliminated C. It guarantees that each exception identified represents a confirmed payroll control failure D. It will always require substantially less audit effort than performing a sample-based test

Question 5

An IS auditor at an insurance company applies Benford's Law to a full year of claim-reimbursement amounts and finds that the leading-digit distribution deviates sharply from the frequencies the model predicts. No other testing has yet been performed on the population. Based on this analytical result alone, which conclusion is MOST appropriate for the auditor to reach?

A. The anomaly warrants further investigation into possible manipulation of reimbursement amounts B. The claim data has been definitively falsified by processing staff and must be reported as fraud C. The reimbursement control has clearly failed and should be reported to management as a deficiency D. The deviation confirms the reimbursement population is free of irregularities and errors

Question 6

A financial services firm engages its IS auditor to perform a data analytics review over customer refund transactions processed during the year. The auditor is eager to move quickly and begins requesting data extracts so testing can start right away. To ensure the analytics engagement is effective and defensible, what should the auditor establish FIRST?

A. The interactive visualization dashboards that will ultimately present the analytics results to management B. The software licensing and computing capacity needed to process the large refund datasets efficiently C. The specific audit objectives and control questions the analytics must address D. The secure archival location and retention period for the extracted refund data files

Question 7

An IS auditor reviewing a logistics company wants ongoing assurance that only authorized changes to master supplier data occur in the production system. The auditor proposes embedding routines inside the application that capture and record transactions meeting defined audit criteria, writing them to a separate file for later review. Which analytics technique is the auditor describing?

A. Generalized audit software executed on periodic extracts B. A systems control audit review file (SCARF) embedded audit module C. An integrated test facility that processes fictitious transactions D. Parallel simulation that reprocesses data independently

Question 8

An IS auditor obtains a system extract of purchase orders in order to perform full-population analytics but is concerned the file may not include every record generated during the period under review. The auditor wants strong assurance before drawing conclusions from the data. Which procedure provides the BEST assurance that the extracted dataset is complete?

A. Reviewing the extract file's creation timestamp and technical metadata B. Confirming with the IT staff member who generated and delivered the extract C. Reconciling record counts and control totals to the source system D. Sorting the data to check for gaps in the sequential purchase-order numbers

Question 9

During a continuous-monitoring engagement at an energy utility, an IS auditor's analytics routine generates a high volume of daily exception alerts, and the majority prove on review to be false positives. Operations management complains that the alerts are unmanageable and are eroding confidence in the audit tool. What is the auditor's BEST course of action?

A. Refine the exception criteria and thresholds to improve alert precision B. Disable the monitoring routine until management formally requests analytics again in the future C. Forward all raw exception alerts to operations management for their own independent review D. Replace continuous monitoring with an annual sample-based test to reduce the alert volume

Question 10

An IS auditor presents data analytics results showing a cluster of after-hours journal entries posted by a single user to a cloud-based ERP during month-end close. Management explains that the entries relate to a legitimate automated closing job that runs overnight. Given only this explanation and the analytics output, which conclusion is MOST appropriate for the auditor?

A. Report the entries as a segregation-of-duties violation without performing any additional procedures B. Accept management's explanation at face value and close the matter immediately without documentation C. Corroborate management's explanation with independent supporting evidence D. Remove the flagged entries from the dataset as confirmed false positives and rerun the routine

Related Posts

Leave a Comment Cancel Reply