CISA Domain 1B-1 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-1 (Audit Project Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-1 Audit Project Management Practice Test 002

10 questions • Single best answer

Question 1

A state university's internal audit function is launching its first review of a newly outsourced student records platform. The engagement lead has been given a fixed budget and a reporting deadline set by the audit committee, but no detailed plan yet exists. What should the audit project manager do FIRST when building the engagement plan?

A. Assign available staff to the anticipated fieldwork tasks and monitor hours weekly against the approved budget. B. Define the engagement objectives and scope, then estimate the resources and time each audit phase requires. C. Request that the audit committee extend the reporting deadline to accommodate the outsourced environment. D. Obtain the service provider's most recent assurance report and design tests around the controls it describes.

Question 2

Midway through fieldwork on a manufacturer's ERP access review, business managers ask the audit team to also examine unrelated payroll processing complaints. Satisfying the request would consume roughly a third of the remaining engagement hours. What is the audit project manager's BEST course of action?

A. Absorb the payroll work into the current engagement and extend fieldwork to preserve stakeholder goodwill. B. Decline the request and advise the managers to raise the payroll concerns after the report is issued. C. Evaluate the request against the approved scope and refer it to audit management for planning consideration. D. Perform limited payroll walkthroughs now and expand testing only if control weaknesses are identified.

Question 3

An IS audit engagement is seventy percent through its allotted hours, but only about forty percent of the planned test procedures are complete. Two team members have been reassigned to another review, and the engagement manager has not reported any variance to the chief audit executive. Which of the following is the MOST significant concern?

A. Progress monitoring is not triggering escalation, so corrective action cannot be taken in time. B. The original engagement estimates were understated given the complexity of the systems in scope. C. Staff reassignment occurred without a documented amendment to the approved engagement plan. D. The remaining procedures may have to be performed by less experienced audit personnel.

Question 4

A bank's audit plan includes a review of a newly deployed cloud container platform, but no team member has relevant technical experience. The chief audit executive intends to engage an external specialist to perform the technical procedures. Which of the following is MOST important for the audit project manager to establish before the work begins?

A. The specialist's fees can be accommodated within the engagement budget approved by the audit committee. B. The specialist will follow the audit function's workpaper templates, naming conventions, and filing standards. C. The specialist will report engagement progress directly to the business unit sponsoring the container platform. D. The audit function retains responsibility for the conclusions drawn from the specialist's work.

Question 5

During a quality review of a completed healthcare application audit, the reviewer finds detailed workpapers whose conclusions appear supported by the evidence on file. The engagement was staffed entirely by first-year auditors, and no workpaper shows evidence of supervisory sign-off. Which finding should the reviewer report as MOST significant?

A. Junior staff performed the entire engagement without a documented competency assessment on file. B. The workpapers contain excessive detail relative to the risks the engagement was designed to address. C. Conclusions were reached before the engagement manager validated the sampling approach used. D. Supervisory review was not evidenced, so the adequacy of the work performed cannot be demonstrated.

Question 6

A government agency's IS audit team identifies a significant weakness in payment processing during the second week of a twelve-week engagement, and the weakness could permit duplicate disbursements. The approved engagement plan provides for findings to be communicated in the final report. What should the audit project manager do?

A. Communicate the weakness to management promptly so that timely corrective action can begin. B. Document the issue in the workpapers and include it in the final report as originally planned. C. Suspend fieldwork until management has remediated the weakness and then resume testing. D. Expand the engagement scope to quantify the total value of duplicate disbursements made to date.

Question 7

An insurance company's annual audit plan allocates fixed hours to each engagement. Two high-risk reviews are now scheduled to run concurrently with a regulatory examination that will require the same audit staff for several weeks. Which action by the chief audit executive is MOST appropriate?

A. Shorten both high-risk engagements so that the original completion dates can still be achieved. B. Use external contractors to perform the regulatory examination support work without changing the plan. C. Reprioritize the plan based on risk and obtain audit committee approval for the revised schedule. D. Defer the lower-rated engagement and notify the affected business units of the schedule change.

Question 8

An IS auditor notes that an engagement work program was modified three times during fieldwork to drop procedures the team could not complete on schedule. The modifications were directed verbally by the engagement lead and are not reflected anywhere in the workpapers. What is the GREATEST risk?

A. Fieldwork hours will exceed the approved engagement budget without a documented cause. B. Planned coverage of assessed risks may be reduced without management's knowledge or approval. C. The audit team will be unable to reperform the dropped procedures in a later audit cycle. D. Business management may dispute the findings because procedures changed during fieldwork.

Question 9

A retail organization's internal audit function is adopting an agile approach that delivers observations to management in short iterative cycles rather than in a single year-end report. The audit committee is concerned that quality may vary between cycles. Which control BEST preserves audit quality under this approach?

A. Requiring each cycle to produce the same number of observations as comparable prior engagements. B. Applying defined engagement standards and supervisory review to every deliverable issued in a cycle. C. Limiting the approach to low-risk processes until the new methodology has been fully validated. D. Having business process owners approve each cycle's observations before they are communicated.

Question 10

During planning for an external audit of a manufacturer's third-party logistics system, the team learns that right-to-audit access must be requested from the vendor thirty days in advance. The engagement is scheduled to begin in two weeks and the vendor has not been contacted. What should the audit project manager do FIRST?

A. Begin fieldwork on internally hosted components and revisit the vendor testing later in the engagement. B. Rely on the vendor's independent assurance report in place of direct testing of the hosted system. C. Revise the engagement timeline and initiate the access request through the contract owner. D. Report a scope limitation to the audit committee and proceed with the remaining planned procedures.

Related Posts

Leave a Comment Cancel Reply