CISA Domain 1A Practice Test 001

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain A (Planning) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA Practice Test — 1A (Planning)

10 questions • Single best answer

Question 1

During the planning of an external audit at a healthcare provider, an IS auditor discovers that a close relative manages the IT department being reviewed. What should the auditor do FIRST?

A. Disclose the relationship to audit management and assess the impact on independence. B. Continue the engagement and note the relationship in the working papers at completion. C. Withdraw from the audit immediately without informing anyone. D. Proceed, since planning activities do not require auditor objectivity.

Question 2

A financial institution asks internal audit to determine whether its data retention practices satisfy a specific regulatory requirement. Which type of audit is MOST appropriate?

A. Compliance audit B. Operational audit C. Financial statement audit D. Forensic audit

Question 3

An IS auditor is developing the annual audit plan for an enterprise IT function. Which factor should have the GREATEST influence on which areas receive audit coverage?

A. The inherent risk and business criticality of each area B. The availability of existing process documentation C. Which areas were audited most recently D. The scheduling preferences of the IT steering committee

Question 4

A government agency installs software that blocks unauthorized changes to production systems before they can be applied. How is this control BEST classified?

A. Preventive control B. Detective control C. Corrective control D. Compensating control

Question 5

While planning an audit of a manufacturing firm's financial applications, an IS auditor must decide which control weaknesses could significantly affect the financial statements. This determination BEST reflects the concept of:

A. Materiality B. Sampling risk C. Control self-assessment D. Detection risk

Question 6

An IS auditor is uncertain whether a particular audit procedure is required by professional standards. Which source establishes MANDATORY requirements the auditor must follow?

A. IS audit standards B. IS audit guidelines C. Industry technical white papers D. Prior-year audit working papers

Question 7

During planning, an IS auditor finds that a small IT team cannot achieve adequate segregation of duties between development and production. Which compensating control provides the BEST assurance?

A. Independent management review of system activity and change logs B. Requiring all IT staff to sign an annual code of conduct C. Enforcing stronger password complexity requirements D. Rotating the batch job schedule each quarter

Question 8

Before assigning resources for the yearly plan, an IS auditor compiles an audit universe. What is the PRIMARY purpose of the audit universe?

A. To identify all auditable entities so risk-based prioritization can be performed B. To summarize findings and recommendations from prior audits C. To set the department's annual audit budget D. To define sampling parameters for fieldwork testing

Question 9

Management asks internal audit to review a new payroll system before go-live to provide assurance on the adequacy of control design. This engagement is BEST described as a:

A. Pre-implementation review B. Post-implementation review C. Substantive test of balances D. Forensic examination

Question 10

An IS auditor is offered a paid role to design the access controls for a cloud system the auditor is later scheduled to audit. What is the auditor's BEST course of action?

A. Decline the audit of that system to preserve independence from work self-performed B. Accept both roles and disclose the conflict only if a stakeholder asks C. Perform the audit but reduce the testing scope to save time D. Design the controls and personally audit them to ensure consistency

Related Posts

Leave a Comment Cancel Reply