CISA Domain 1B-6 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-6 (Quality Assurance and Improvement of Audit Process) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-6 Quality Assurance and Improvement of Audit Process Practice Test 002

10 questions • Single best answer

Question 1

A pharmaceutical company's audit committee notes that every IS audit report states the work was performed in conformance with ISACA IS audit standards. The audit function has completed no internal or external quality assessments in four years, citing staffing constraints. Which action is MOST appropriate for the chief audit executive?

A. Keep the statement because all staff are certified and follow the documented audit methodology. B. Stop using the conformance statement until assessment results support it and disclose the gap. C. Add a note that the audit manager informally reviews the methodology each year for alignment. D. Commission an external assessment now and keep the statement unchanged while it is in progress.

Question 2

A state university's internal audit department performs quality reviews of IS audit engagement files only after final reports are issued. Recent reviews found several reports whose conclusions were not supported by the evidence in the workpapers. Which improvement would BEST reduce this risk going forward?

A. Increase the number of engagement files selected for post-issuance quality review each year. B. Require auditees to sign off on all supporting workpapers before the final report is released. C. Engage an external assessor to review a sample of issued IS audit reports every year. D. Require documented supervisory review of workpapers against conclusions before report issuance.

Question 3

During a periodic internal quality review at a hospital network, the reviewer finds that an issued identity and access management report concluded controls were operating effectively. However, the workpapers show that only 5 of the 25 planned samples were actually tested. What should the audit manager do FIRST?

A. Determine whether testing the remaining samples could change the reported conclusion. B. Issue a revised report withdrawing the conclusion on identity and access controls. C. Reassign the engagement and address the lapse with the responsible auditor. D. Record the deficiency in the annual quality assurance report presented to the audit committee.

Question 4

A national retail chain's IS audit function sends surveys to auditees after each engagement. Results over the past year show consistently low ratings for the timeliness of communicating preliminary findings, while ratings for report quality remain high. How should the chief audit executive BEST use these results?

A. Exclude the timeliness ratings because auditees may be biased against receiving findings. B. Present the high report quality ratings to the audit committee as evidence of effectiveness. C. Analyze the root cause of the delays and add corrective actions to the improvement program. D. Shorten fieldwork schedules so that final reports reach auditees sooner after closing.

Question 5

A government revenue agency's audit director is selecting performance measures for the IS audit function's continuous improvement program. The oversight board wants measures that clearly reflect the value the function delivers to the agency rather than simply measuring audit activity levels. Which measure is MOST appropriate?

A. Percentage of high-risk findings remediated by management within agreed time frames B. Number of IS audit engagements completed compared with the approved annual audit plan C. Average number of audit hours charged per engagement compared with the approved budget D. Percentage of IS audit staff holding professional certifications such as CISA or CISM

Question 6

An IS audit team at a payments processor uses data analytics scripts to test transaction controls across many engagements each year. A quality review finds that individual auditors modify the scripts as needed, with no version control, peer review, or independent validation. Which recommendation is MOST appropriate?

A. Restrict analytics use to engagements where manual sampling is not practical. B. Require the auditee's IT team to review the scripts before each engagement. C. Retain script output files in the workpapers so results can be traced later. D. Establish change control and independent validation of scripts before use.

Question 7

An energy utility's annual IS audit plan includes a review of operational technology controls at its generation plants. During planning, the audit manager determines that no team member has operational technology experience, and fieldwork is scheduled to begin in three weeks. What is the audit manager's BEST course of action?

A. Proceed with the engagement and disclose the team's limited experience in the final report. B. Engage a qualified specialist and evaluate the adequacy of the specialist's work for the audit. C. Postpone the engagement indefinitely until internal staff complete operational technology training. D. Narrow the scope to IT general controls that the current team is already competent to test.

Question 8

A quality reviewer at a public accounting firm examines an IS audit engagement file covering a client's ERP change management controls. The test steps are marked 'tested, no exceptions,' but they do not identify the items sampled, the evidence sources, or the procedures performed. Which finding is MOST significant?

A. The engagement file does not include a signed auditee acknowledgment of the test results. B. The workpaper format differs from the firm's standard template for change management testing. C. Another auditor could not reperform the tests or confirm the basis for the reported conclusion. D. The test steps do not reference the specific policy clauses that each tested control supports.

Question 9

Following an external quality assessment, a biotechnology firm's IS audit function receives a 'partially conforms' rating because of weak risk assessment practices in engagement planning. The chief audit executive proposes sharing the results only with the CIO to avoid alarming the board. What is the MOST appropriate action?

A. Share the results with the CIO and resolve the issues before the next assessment cycle. B. Ask the assessor to revise the rating after the planned improvements have been completed. C. Report only the corrected practices to the audit committee once remediation is verified. D. Communicate the results and a corrective action plan to the audit committee promptly.

Question 10

An audit manager at a regional airline reviews lessons-learned records from the last eight IS audit engagements. Most records cite scope changes after fieldwork began and budget overruns caused by repeated delays in obtaining required data from auditees. Which action would BEST improve the audit process?

A. Update the planning methodology to confirm data needs and scope before fieldwork begins. B. Add contingency hours to each engagement budget to absorb future schedule overruns. C. Discuss the issues with each engagement lead during their individual performance reviews. D. Escalate the late data requests to senior management as auditee noncompliance.

Related Posts

Leave a Comment Cancel Reply