CISA Domain 1A-2 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain A-2 (Types of Audits, Assessments, and Reviews) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1A-2 Types of Audits, Assessments, and Reviews Practice Test 002

10 questions • Single best answer

Question 1

A government agency's audit committee asks the IS audit function to determine whether its benefits payment system satisfies national data protection legislation. The committee states that it wants assurance confined to statutory obligations rather than the efficiency or effectiveness of underlying processing operations. Which type of engagement is MOST appropriate?

A. A compliance audit assessing adherence to the applicable legal requirements B. An operational audit evaluating the efficiency of benefits processing C. An integrated audit combining financial balances and supporting IT controls D. A forensic audit examining transaction records for indicators of irregularity

Question 2

An IS auditor is assessing controls at a cloud payroll provider used by a retail organization. Management offers a SOC 2 Type 1 report issued three months ago, a provider-prepared security summary, and the security schedule attached to the service contract. Which item provides the BEST assurance that provider controls operated effectively during the year?

A. The SOC 2 Type 1 report describing control design at a single point in time B. The provider's internally prepared annual information security summary report C. The security requirements specified in the outsourcing contract schedule D. A SOC 2 Type 2 report covering the full period under audit review

Question 3

A bank's chief audit executive wants a single engagement that examines revenue recognition balances together with the application controls and system interfaces producing those balances. The intended outcome is one set of conclusions addressing both financial statement assertions and the supporting IT control environment. Which type of audit BEST meets this objective?

A. An integrated audit covering financial assertions and related IT controls B. A compliance audit confirming adherence to applicable accounting regulations C. An operational audit assessing the efficiency of revenue processing activities D. A financial audit supplemented later by a separately scoped IS control review

Question 4

While reviewing a utility company's procurement system, an IS auditor finds vendor master records altered outside approved change windows, with several approvals traced to a terminated employee's account. Management suspects misappropriation of funds and asks the auditor to expand the engagement immediately. What is the auditor's BEST course of action?

A. Continue the planned audit and report the anomalies as a control deficiency B. Recommend a forensic examination conducted under documented chain-of-custody procedures C. Interview staff who had update access to the vendor master file records D. Disable the implicated accounts and arrange reprocessing of the affected payments

Question 5

A manufacturing company's internal audit function relies on control self-assessment workshops facilitated with business process owners to evaluate IT operational controls. The audit committee asks whether conclusions produced by those workshops can be reported to it as assurance over the control environment. Which limitation is MOST significant?

A. Facilitated workshops consume substantial staff time and scheduling effort B. Workshop outcomes are not captured in a standardized documentation format C. Participants assess controls they own, so conclusions lack independence D. Workshops address only those controls that management already considers key

Question 6

A financial services firm submits quarterly vulnerability scan reports as evidence that its internet-facing applications are adequately protected. The IS auditor must conclude whether the weaknesses identified in those reports are actually exploitable within the production environment. Which approach provides the BEST evidence supporting that conclusion?

A. Reviewing scanner configuration settings and evidence of scan coverage completeness B. Comparing the reported scan results against the firm's patch deployment records C. Performing an authorized penetration test against the production applications D. Obtaining management's remediation tracking log for previously reported findings

Question 7

Eighteen months after a hospital deployed an electronic health record platform, the steering committee wants to know whether projected clinical and financial benefits were achieved and whether controls designed during the project operate as intended. Which type of review is MOST appropriate to meet this objective?

A. A post-implementation review evaluating realized benefits and operating controls B. A readiness assessment confirming that the platform can be moved into production C. A pre-implementation review of the designed configuration and control requirements D. An operational audit of the software vendor's ongoing support and maintenance

Question 8

An insurance company engages an IS audit firm to execute a defined list of procedures over privileged account provisioning and to report factual results without expressing an opinion. The audit committee later asks whether the engagement concluded that access provisioning controls are effective. Which response is MOST appropriate?

A. The engagement expresses an opinion limited to the provisioning controls tested B. The engagement reports factual findings only, leaving users to form their own conclusions C. The engagement conveys reasonable assurance over the access control environment D. The engagement conveys limited assurance comparable to a formal review engagement

Question 9

An external IS auditor plans to rely on an energy company's internal audit testing of change management controls in order to reduce planned substantive procedures. The internal audit department reports both administratively and functionally to the chief information officer. What should the external auditor do FIRST?

A. Reperform a representative sample of internal audit's change management test work B. Evaluate internal audit's organizational objectivity, competence, and quality of work C. Exclude internal audit's results and independently perform all change management testing D. Obtain management confirmation that internal audit's prior findings were remediated

Question 10

A telecommunications provider's IT service desk consistently meets its contractual response-time targets, yet business units report repeated recurrence of the same unresolved issues. The audit committee wants to understand how well the function actually performs its role. Which type of audit should the IS auditor recommend?

A. A compliance audit verifying adherence to the service level agreement targets B. A financial audit examining service desk operating costs and staffing charges C. A forensic review of ticket closure records to detect manipulated resolution data D. An operational audit of service desk processes, efficiency, and effectiveness

Related Posts

Leave a Comment Cancel Reply