CISA Domain 1A-4 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain A-4 (Types of Controls and Considerations) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1A-4 Types of Controls and Considerations Practice Test 002

10 questions • Single best answer

Question 1

During an audit of a logistics company's warehouse management system, the IS auditor finds that one administrator can both create and approve inventory adjustments without a second review. Management responds that the operations manager reviews a monthly report of all adjustments exceeding a defined value threshold. How should the auditor characterize the monthly review?

A. A compensating detective control that only partially mitigates the segregation of duties weakness B. A preventive control that removes the segregation of duties weakness in the adjustment process C. A directive control that communicates expected behavior for processing inventory adjustments D. A corrective control that restores inventory balances to their originally approved condition

Question 2

An IS auditor at a hospital is evaluating controls over a newly deployed e-prescribing application. The system enforces programmed dosage limits at data entry, and nursing supervisors also perform a daily manual review of alerts that clinicians overrode. Which control provides the BEST assurance that out-of-range dosages are not entered into the system?

A. The daily supervisory review of alerts that clinicians chose to override at entry B. The application's programmed dosage limit edit check applied at the point of entry C. The clinical prescribing policy acknowledged in writing by all licensed prescribing staff D. The periodic recertification of user access rights assigned to the prescribing module

Question 3

A government agency's IS auditor confirms that the documented change management procedure requires independent approval before any code is promoted to production. Testing of 25 production changes from the audit period shows that six were promoted with no evidence of approval. Which conclusion is MOST appropriate based on this evidence?

A. The control is deficient in design and the approval requirement should be redesigned B. The control is operating effectively because the large majority of changes were approved C. The control is suitably designed but is not operating effectively during the period D. The exceptions indicate a weakness in the corrective controls applied to failed changes

Question 4

A financial services firm protects its data center with badge readers, mantrap doors, warning signage stating that the area is under continuous surveillance, and cameras whose footage is retained for post-incident review. The IS auditor is documenting each measure by control type in the workpapers. Which measure is BEST described as a deterrent control?

A. The warning signage stating that the area is under continuous surveillance B. The badge readers that restrict data center entry to authorized personnel only C. The mantrap doors that stop a second person from tailgating into the facility D. The retained camera footage that is examined after a security incident occurs

Question 5

An IS auditor reviewing a university's legacy payroll system finds that activity cannot be traced to individuals because four clerks share one privileged account. The vendor cannot add individual accounts before the system is retired next year. Which compensating control would provide the BEST assurance over accountability for payroll master file changes?

A. Requiring each clerk to sign an annual acknowledgment of the acceptable use policy B. Encrypting the payroll database and limiting connectivity to the finance network segment C. Obtaining an annual vendor attestation describing the platform's built-in security features D. Reconciling every master file change to an authorized request form signed by a named approver

Question 6

During an audit of an outsourced cloud billing service, the IS auditor notes that the provider generates a daily exception report listing transactions that failed to post. Client staff review the report each following morning and resubmit the affected items. How should the exception report review itself be classified in the control matrix?

A. Preventive, because failed transactions are identified before customer settlement occurs B. Detective, because it identifies processing errors after the transactions have been processed C. Corrective, because the reported items are subsequently resubmitted into the billing cycle D. Directive, because the outsourcing contract obligates the provider to issue the report daily

Question 7

An IS auditor is scoping a review of an order-to-cash process that management has documented with 40 separate application and manual controls. Available audit time and staffing permit detailed testing of only a portion of them. Which basis for selecting the controls to be tested is MOST appropriate?

A. Select the key controls that address the most significant risks to the process objectives B. Select the automated controls, because they operate uniformly across all transactions processed C. Select the most recently implemented controls, because they have the shortest operating history D. Select a random sample from the 40 controls to obtain unbiased coverage of the process

Question 8

During an audit of a retailer's inventory application, the IS auditor confirms that the programmed edit checks over quantity and pricing are well designed. Testing of the supporting environment shows that several developers retain standing write access to the production database. Which conclusion about reliance on the application controls is MOST appropriate?

A. Reliance remains appropriate, since the edit checks operate independently of database access rights B. Reliance is unaffected, because the developer access issue is reported separately as an access finding C. Reliance is reduced, because weak general controls undermine the integrity of application controls D. Reliance is appropriate provided that developer activity is reviewed annually by IT management

Question 9

An IS auditor has completed control testing over a bank's wire transfer platform and must rank the findings for presentation to the audit committee. Weaknesses were noted across preventive, detective, and corrective controls of differing importance and timing. Which of the following findings is MOST significant?

A. Daily wire reconciliations are consistently completed two business days after the transfer date B. The wire platform user guide has not been refreshed since the most recent software release C. Corrective procedures for rejected wires are documented but have rarely been exercised in practice D. Dual authorization for high-value wires can be bypassed by the platform administrator account

Question 10

A manufacturer's internal audit team plans to rely on the automated three-way match control in the purchasing system. The control was tested and concluded effective during last year's audit, and IT management states that no changes have been made to it since. What is the auditor's BEST course of action this year?

A. Rely on the prior year's conclusion, since automated controls operate consistently once configured B. Test the general controls over program changes and confirm that the configuration remains unchanged C. Re-perform detailed transaction testing on a large statistical sample of purchase orders for the year D. Obtain a management self-assessment confirming that the matching control continues to function

Related Posts

Leave a Comment Cancel Reply