CISA Domain 1A-4 Practice Test 001

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain A-4 (Types of Controls and Considerations) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1A-4 Types of Controls and Considerations Practice Test 001

10 questions • Single best answer

Question 1

During an audit of a retail e-commerce payment environment, an IS auditor notes that segregation of duties cannot be enforced because the small team lets one administrator both configure and approve system changes. Management points to a daily supervisory review of change logs. Which type of control is management relying on to address this exposure?

A. A preventive control that stops the risk B. A compensating control C. A deterrent control D. A directive control

Question 2

A financial services firm is designing controls for a new online loan origination system and asks the audit team for input on the design. The team wants a control that would prevent unauthorized transactions from being entered rather than merely detect them after the fact. Which control is MOST appropriate to recommend?

A. Input validation and role-based authorization enforced at the point of data entry B. Daily reconciliation of the transaction register C. Periodic management review of exception reports D. After-the-fact analysis of the system audit trail

Question 3

During a review of a hospital's electronic health record system, an IS auditor is assessing the mix of controls protecting patient data from inappropriate access. Several controls operate across the environment. Which of the following would function as a detective control rather than as a preventive control?

A. Automatic session lockout triggered after repeated failed logins B. Role-based access restrictions preventing users from opening record types they lack rights to C. Periodic review of access logs for anomalous activity D. Mandatory encryption of stored patient records

Question 4

An IS auditor is scoping a review of a logistics company's ERP system and must decide where to place reliance during the engagement. The auditor primarily wants assurance that completeness and accuracy are enforced within the specific accounts payable module. Which category of control is MOST directly relevant to that objective?

A. IT general controls over the underlying operating system B. Application controls embedded within the accounts payable module C. Physical access controls over the data center D. Network perimeter controls at the enterprise boundary

Question 5

An IS auditor plans to rely on automated application controls in a subscription billing system in order to reduce substantive testing. The controls appear well designed based on an initial walkthrough. Before concluding that such reliance is appropriate, which consideration is MOST important to the auditor's planning?

A. Whether IT general controls supporting the application are effective B. Whether users find the application interface easy to operate on a daily basis C. Whether the vendor is widely used across the industry D. Whether the application was recently upgraded

Question 6

During an audit of a government agency's legacy financial system, the IS auditor finds during fieldwork that a required preventive control is entirely absent, but management has implemented a manual reconciliation instead. Which factor should the auditor MOST consider when evaluating whether this compensating control is adequate?

A. Whether the compensating control addresses the same risk with sufficient rigor B. Whether the compensating control is cheaper to operate than the originally intended preventive control C. Whether staff prefer performing the manual reconciliation D. Whether the compensating control is documented in the policy manual

Question 7

A post-implementation review at a media streaming company examines the controls that restore service and repair data integrity after a batch processing error corrupts customer records. The auditor wants to classify these controls accurately in the working papers. Which type of control is primarily being evaluated here?

A. Preventive control B. Detective control C. Corrective control D. Deterrent control

Question 8

An IS auditor is comparing two controls that address the same risk of duplicate vendor payments: one is an automated system edit, and the other is a manual review performed by accounts staff. Assuming both are properly designed, which statement BEST reflects an audit consideration regarding control type?

A. The automated control generally operates more consistently across every transaction B. The manual control is inherently more reliable because a human applies professional judgment C. Automated controls never require testing once they have been implemented D. Manual controls remove the need to assess supporting IT general controls

Question 9

During planning for an audit of an insurance claims settlement process, the IS auditor has limited time and must decide which controls to test during the engagement. Many controls of varying importance operate across the process. To provide effective assurance efficiently, which controls should the auditor prioritize for testing?

A. Key controls on which the achievement of the control objectives most depends B. Controls that are the easiest and quickest to test C. Controls that management implemented most recently D. Every control in the process regardless of significance

Question 10

An IS auditor evaluating a payroll application observes strong detective controls but weak preventive controls, so processing errors are consistently caught only after payments have already been issued to employees. Considering this specific control design weakness, which recommendation is MOST appropriate for the auditor to make in the report?

A. Strengthen preventive controls so errors are stopped before payments are processed B. Remove the detective controls to reduce duplication of effort C. Rely solely on the existing detective controls since errors are eventually found D. Increase the frequency of after-the-fact reconciliations

Related Posts

Leave a Comment Cancel Reply