CISA Domain 1B-5 Practice Test 001

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-5 (Reporting and Communication Techniques) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-5 Reporting and Communication Techniques Practice Test 001

10 questions • Single best answer

Question 1

A public university's IS audit team has completed fieldwork on its student records system and is now drafting the final report. During the closing meeting, the system owner disputes one finding and provides new documentation indicating that a compensating control already exists. Before the report is issued, what should the IS auditor do FIRST?

A. Remove the disputed finding from the report entirely so that a cooperative working relationship with the system owner is preserved going forward B. Issue the report as drafted and record the system owner's disagreement in an appendix C. Evaluate the new documentation to determine whether it changes the finding or its rating D. Escalate the disagreement to the audit committee for a final ruling

Question 2

An IS auditor is preparing to communicate the results of a review of a healthcare provider's identity and access management controls. Several findings involve technical configuration weaknesses, but the primary recipient of the report is the organization's audit committee. Which reporting approach is MOST appropriate for communicating to this audience?

A. Present the detailed technical configuration logs so that the committee is able to independently validate each identified weakness itself B. Frame findings as business risks and potential impacts, with technical detail available on request C. Defer reporting until IT management has remediated the configuration weaknesses D. Limit the report to an overall opinion without describing individual findings

Question 3

During an audit of a manufacturing firm's procurement system, the IS auditor identifies a control weakness that could allow duplicate vendor payments to be processed. Fieldwork is only half complete, but the exposure appears significant and is currently ongoing. Regarding communication, what is the auditor's BEST course of action?

A. Wait until the final report is issued to disclose the weakness so that it can first be fully substantiated in detail B. Communicate the significant issue to management promptly rather than waiting for the final report C. Instruct the process owner to suspend all payments until fieldwork concludes D. Note the issue in the working papers only and address it in the next cycle

Question 4

An IS audit report on a government agency's disaster recovery program contains ten findings of varying severity, ranging from minor to critical. The agency's senior leadership has limited time to review the full document. Which reporting element BEST helps decision-makers focus on the matters that require the most urgent attention?

A. A detailed methodology section describing the audit approach B. An appendix listing every document and system examined C. An executive summary that prioritizes findings by risk and significance D. A glossary defining the technical terms in the report

Question 5

A financial services organization's IS auditor has finalized a report that contains a finding management strongly disagrees with. Management has submitted a written response asserting that the associated risk is acceptable and requires no further action. How should the auditor MOST appropriately handle this disagreement in the final report?

A. Adjust the finding so that it aligns with management's stated position in order to reach a mutual consensus view B. Retain the finding and include management's response reflecting its differing view C. Withdraw the finding because management has accepted the associated risk D. Replace the finding with a general observation to soften the disagreement

Question 6

An IS auditor is drafting recommendations after completing an audit of a large retailer's change management process. One finding is well documented at the symptom level, but its underlying cause has not yet been clearly established. Which characteristic is MOST important for the recommendation to be effective and actionable for management?

A. It addresses the underlying root cause of the identified condition B. It specifies the exact technology product to purchase C. It assigns employees personal responsibility for the failure D. It restates the finding in greater technical detail

Question 7

Six months after issuing an audit report on an insurer's data center operations, the IS auditor begins post-audit follow-up procedures. Management has reported that all of the agreed corrective actions were completed on schedule. Which approach provides the BEST assurance that the reported remediation is actually effective?

A. Obtain management's written confirmation stating that all of the agreed corrective actions have now been fully implemented as planned B. Review the status update presented at the last audit committee meeting C. Independently test whether the implemented controls are operating effectively D. Accept the remediation as complete since the agreed deadline has passed

Question 8

An IS auditor is finalizing a report and must communicate an overall conclusion on the effectiveness of a logistics company's IT general controls. The evidence shows that most controls are operating effectively, but one pervasive weakness affects multiple systems. How should the auditor MOST appropriately frame the overall conclusion?

A. Issue an unqualified positive conclusion on the basis that the majority of tested controls were effective B. Reflect the pervasive weakness and its effect on overall control effectiveness C. Omit the overall conclusion and present only the individual findings D. State that controls are ineffective based on the single weakness

Question 9

A cloud migration review at a media company produced several findings that management has agreed to remediate over the coming quarter. As the auditor documents the agreed action plan within the report, which element is MOST important for enabling effective and timely post-audit follow-up at a later date?

A. A narrative describing the auditor's testing procedures and the sampling approach used during fieldwork B. Named remediation owners and target completion dates for each agreed action C. A ranking of the findings by the order in which each was discovered D. The list of audit team members who performed the fieldwork

Question 10

While drafting the final report, an IS auditor discovers that a previously reported finding was based on incomplete data and significantly overstated the exposure. The report has already been shared in draft form with management, but it has not yet been formally issued. What is the auditor's BEST course of action?

A. Issue the report unchanged in order to avoid signaling any apparent inconsistency to management B. Correct the finding to reflect the accurate exposure before issuing the report C. Add a footnote acknowledging the data was incomplete without changing the finding D. Remove the finding entirely since the original data proved unreliable

Related Posts

Leave a Comment Cancel Reply