CISA Domain 1A-3 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain A-3 (Risk-Based Audit Planning) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1A-3 Risk-Based Audit Planning Practice Test 002

10 questions • Single best answer

Question 1

A newly appointed IS audit director at a regional insurance company is developing the function's first annual audit plan. Business unit heads each nominate systems they believe are high risk, and the IT department separately proposes coverage of recently deployed platforms. What should the director do FIRST?

A. Schedule audits of the systems that business unit heads nominated as high risk B. Allocate audit hours evenly across business units so that coverage remains balanced C. Develop an IT audit universe mapped to business processes and supporting systems D. Review prior external audit reports and carry forward their unresolved findings

Question 2

During development of a risk-based audit plan at a hospital network, the audit team scores each auditable entity using likelihood and impact ratings supplied directly by system owners. No independent corroboration or challenge of those ratings is performed before the plan is finalized. Which concern is MOST significant to the IS auditor?

A. Self-reported risk ratings may understate exposure and bias the resulting plan coverage B. Likelihood and impact scoring is inappropriate for clinical healthcare information systems C. System owners lack sufficient technical knowledge to describe their own applications D. The methodology does not produce quantified monetary loss values for each entity

Question 3

An IS audit manager at a retail bank has completed the annual risk-based audit plan and intends to begin fieldwork immediately. The finalized plan reallocates coverage away from two areas that senior management had previously asked to have audited this year. What is the auditor's BEST course of action?

A. Proceed with the plan because risk assessment results override management requests B. Reinstate the two areas to preserve the relationship with senior management C. Document the rationale in the working papers and retain it for later inspection D. Submit the plan with supporting rationale to the audit committee for approval

Question 4

Six months into the audit year, a logistics company migrates its core warehouse management system to a public cloud provider. The approved risk-based audit plan contains no coverage of cloud environments, and audit resources are already fully committed to scheduled engagements. Which action is MOST appropriate for the IS audit function?

A. Complete the approved plan as issued and add cloud coverage to next year's plan B. Reassess risk, revise the plan, and obtain audit committee approval for the changes C. Ask management to defer the migration until audit coverage can be arranged D. Perform an unscheduled advisory review of the migration using existing resources

Question 5

An IS auditor planning a risk-based audit at a utility company is offered management's enterprise risk register as the sole basis for selecting engagements. The register was last refreshed eighteen months ago and covers strategic and financial risks but excludes IT operational and technology risks. Which conclusion is MOST appropriate?

A. The register is acceptable because enterprise risk management owns risk identification B. The register should be replaced by a control self-assessment completed by IT staff C. The register is insufficient and must be supplemented by independent risk analysis D. The register indicates a material weakness that should be reported to regulators

Question 6

While prioritizing auditable entities at a payments processor, the audit team ranks a legacy settlement platform as low priority because compensating controls were rated effective during a review completed three years ago. No control testing has been performed since. Which factor MOST undermines the validity of this prioritization decision?

A. Control effectiveness has not been reassessed, so residual risk may be understated B. Legacy platforms should always receive annual coverage regardless of control ratings C. Compensating controls cannot be relied on when ranking auditable entities by risk D. Inherent risk rather than residual risk should determine the ranking of entities

Question 7

A risk-based audit plan at a manufacturing group identifies industrial control system security as the highest-rated area. The internal audit team has no operational technology expertise, has never audited the plant environment, and cannot recruit qualified specialists within the plan year. What is the audit director's BEST course of action?

A. Lower the assessed risk rating of the area to reflect the audit function's capability B. Engage an external specialist and retain supervisory responsibility for the work C. Defer the engagement and disclose the limitation in the annual audit report D. Substitute a questionnaire-based self-assessment performed by plant engineers

Question 8

An audit committee questions why the risk-based plan at a telecommunications firm allocates forty percent of available audit hours to customer billing systems. The audit director has been asked to justify the allocation at the committee's next meeting. Which of the following provides the BEST support for that allocation?

A. Benchmarking data showing that peer audit functions devote similar effort to billing B. A memorandum from the chief financial officer endorsing the proposed allocation C. The volume of prior-year audit findings recorded against the billing environment D. Documented risk assessment results linking billing risks to business objectives

Question 9

An IS auditor reviews a three-year rolling audit plan at an insurance group and finds that several entities rated high risk are scheduled for coverage only in year three, while entities rated low risk are audited every year. Which finding is MOST significant for the audit committee?

A. The plan spans three years rather than being refreshed on an annual basis B. Low-risk entities consume hours that could be redirected to advisory services C. Audit coverage frequency is not aligned with the assessed risk of each entity D. The plan does not specify the audit methodology to be applied to each entity

Question 10

During planning of a risk-based audit at a government ministry, the chief information officer asks that a troubled ERP implementation be dropped from the committee-approved plan because remediation is under way. The auditor confirms the engagement remains the highest-rated exposure. What should the IS auditor do FIRST?

A. Report the requested scope restriction to the audit committee for resolution B. Remove the engagement and reschedule it once remediation activity concludes C. Accept the assurance offered and rely on the remediation project's status reports D. Narrow the engagement to areas the chief information officer agrees to allow

Related Posts

Leave a Comment Cancel Reply