CISA Domain 3A-1 Practice Test 001

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A-1 (Project Governance and Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3A-1 Project Governance and Management Practice Test 001

10 questions • Single best answer

Question 1

A retail organization is launching a multiyear ERP program. The IS auditor observes that the project steering committee lacks an executive sponsor, meets only sporadically, and the IT project manager unilaterally approves all scope and budget changes without escalation. Which of the following is the MOST significant project governance concern?

A. The absence of independent oversight over scope and budget decisions B. The project manager holds professional certifications that have expired C. Meeting minutes are stored on a shared drive without version control D. The steering committee includes no representation from external vendors

Question 2

An IS auditor begins a review of project governance for a newly approved software initiative at an energy company. Before assessing whether controls are adequate, the auditor wants to understand how decisions are authorized, escalated, and monitored. Which of the following should the auditor review FIRST?

A. The detailed test plans prepared by the development team B. The user acceptance testing results from the pilot phase C. The approved project charter defining governance roles and decision authority D. The vendor's service level agreements covering post-implementation production support

Question 3

During a review of IT project governance at an insurance company, the IS auditor wants assurance that an in-flight project remains aligned with strategic business objectives as it progresses through successive phases. Market conditions have shifted since approval, yet management insists the initiative remains on track. Which of the following provides the BEST evidence of ongoing alignment?

A. A signed contract with the selected software vendor B. The approved business case reviewed and reaffirmed at each stage gate C. Positive feedback from end users during requirements workshops D. A detailed project schedule showing all tasks currently on the critical path

Question 4

An audit manager evaluates governance of a large system implementation at a manufacturing firm. The project steering committee approves initial funding but then delegates all stage-gate go/no-go decisions entirely to the project manager, who also defines the criteria for passing each gate. Which of the following is the MOST appropriate recommendation?

A. Increase the frequency of routine project team status meetings B. Require the project manager to obtain additional project certifications C. Expand the project team to include more experienced business analysts D. Reserve stage-gate go/no-go decision authority for the steering committee

Question 5

A post-approval review of a bank's digital lending project finds the original business case was never revised despite a 40% budget increase and a scope expansion into two new markets. Governance meetings continued each month without reassessing viability or expected benefits. Which finding is MOST significant to the IS auditor?

A. The business case was not revalidated after material scope and cost changes B. Status reports were distributed weekly rather than on a biweekly basis C. The project adopted an agile rather than a traditional waterfall methodology D. The project team relocated to a different regional office building during execution

Question 6

While planning an audit of project governance at a logistics company, an IS auditor finds that accountability for project outcomes is unclear, several managers each claim decision authority, and no single individual is answerable for benefits realization. Which of the following should the auditor do FIRST before forming any conclusion?

A. Recommend that a new project sponsor be appointed immediately B. Review governance documentation to determine defined roles and responsibilities C. Report the condition to the audit committee as a significant control failure requiring escalation D. Interview end users about their satisfaction with the delivered system

Question 7

An IS auditor reviews how a healthcare organization selects and prioritizes its IT projects. Numerous initiatives are funded simultaneously with no ranking against strategic criteria, resources are frequently reallocated mid-stream, and several projects appear to duplicate one another's objectives. Which of the following controls would BEST address this condition?

A. A requirement that all projects adopt the same development methodology B. A larger contingency budget allocated to each approved project C. A portfolio management process that prioritizes projects against defined strategic criteria D. More frequent and detailed status reporting collected from each individual project manager

Question 8

An IS auditor questions the reliability of project status reports at a telecommunications company because the project manager self-reports progress with no independent validation, and reported completion has remained at ninety percent for several consecutive reporting cycles. Which of the following provides the BEST assurance that reported project status is accurate?

A. Independent verification of milestone completion against deliverable evidence B. Confirmation that the reports are formatted using the corporate template C. The project manager's signed attestation confirming that the reported figures are accurate D. Timely distribution of the reports to all steering committee members

Question 9

During an audit of IT project governance at a utility, the IS auditor is asked to clarify decision accountability between the oversight body and day-to-day project management. Which of the following is the responsibility of the project steering committee rather than the project manager during the execution of the project?

A. Assigning daily tasks to individual members of the project team B. Maintaining the detailed project work breakdown structure and schedule C. Coordinating resolution of routine day-to-day technical issues D. Approving major changes to project scope, budget, and schedule

Question 10

An IS auditor is invited to join the steering committee of a new financial system project as a voting member because of recognized expertise in application controls and risk. The committee makes binding funding and scope decisions. Which of the following is the auditor's BEST course of action to preserve audit independence?

A. Accept voting membership in order to strengthen control oversight B. Participate only in an advisory, non-voting capacity on control matters C. Decline any involvement with the project until implementation is complete D. Vote on all governance decisions but formally abstain on technical implementation matters

Related Posts

Leave a Comment Cancel Reply