CISA Domain 3A-4 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A-4 (Control Identification and Design) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3A-4 Control Identification and Design Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor engaged by a regional property insurer is reviewing the design of a new claims payment system. To prevent duplicate claim payments, the design team plans to rely on a monthly supervisory review of a paid-claims report. Which recommendation is MOST appropriate?

A. Increase the frequency of the supervisory review of the paid-claims report from monthly to weekly cycles B. Require a second approver for every claim payment that exceeds a defined dollar threshold C. Add an automated edit blocking payment of claims that match a prior policy, loss date, and amount D. Reconcile total paid claims to the general ledger at month-end and investigate any variances

Question 2

A pharmaceutical company is designing a new laboratory information management system. The project sponsor asks the internal IS auditor to create the system's access control matrix and formally approve it so that the project can stay on schedule. What is the IS auditor's BEST course of action?

A. Advise on required control objectives and review the matrix design without designing or approving it B. Design the matrix, because early auditor involvement reduces the cost of retrofitting access controls C. Decline any involvement in the project until the post-implementation review has been scheduled D. Approve the matrix prepared by the project team and document the approval in the audit workpapers

Question 3

An audit manager reviews the control design documentation for a university's new student financial aid system. The document lists more than forty application controls for admissions, disbursements, and refunds, but none are linked to identified risks or stated control objectives. What should the IS auditor do FIRST?

A. Test the operating effectiveness of the listed controls in the user acceptance testing environment B. Recommend adding compensating detective controls to cover any risks the listed controls may miss C. Report the documentation deficiency to the audit committee as a significant project control weakness D. Determine whether a risk assessment was performed to establish the objectives the controls must meet

Question 4

A logistics company is designing a nightly interface that transfers shipment invoices from its warehouse management system to its ERP accounts receivable module. Management wants assurance that every invoice generated in the warehouse system is posted in the ERP. Which designed control provides the BEST assurance?

A. Encryption of the interface file while it is transmitted between the two application servers B. Automated reconciliation of record counts and control totals between the source and target systems C. Field format and data type validation performed by the ERP application when each interface record is received D. An alert generated by the job scheduler whenever the nightly interface job terminates abnormally

Question 5

During a design review of a retail bank's new wire transfer module, the IS auditor notes that transfers exceeding customer limits will be identified through a daily manual review by operations staff. The application platform can enforce limits automatically at initiation. Which design weakness is MOST significant?

A. Reliance on a detective review where a preventive limit check could stop transfers before release B. Retention of reviewer sign-off in electronic form rather than as a signed hard-copy report C. Definition of the customer transfer limits by treasury management rather than by IT architects D. Generation of the exceptions report from the same application that processes the wire transfers

Question 6

A government pension agency is designing a benefits calculation system that allows authorized staff to override system-calculated benefit amounts. The IS auditor is asked to recommend a design control that will provide accountability for overrides, which the legacy system never recorded. Which control is MOST appropriate?

A. Restrict the override capability to a small group of senior supervisors through role-based access B. Require the user to enter a free-text justification before the system will save any override C. Log each override with user, original and new values, and reason, and have it independently reviewed D. Display a warning message to the user whenever a system-calculated benefit amount is about to be changed

Question 7

A national nonprofit is designing a donor management system. The proposed design requires dual authorization for every change to a donor record, and staff estimate this will double processing time for routine address and contact updates. Which recommendation is MOST appropriate for the IS auditor to provide?

A. Retain dual authorization for all donor record changes because it provides the strongest control B. Remove dual authorization and rely on the annual external financial audit to detect any errors C. Accept the risk of unauthorized changes because the organization's size limits segregation of duties D. Apply dual authorization to high-risk changes such as bank details and use periodic review for others

Question 8

A healthcare network is designing an electronic prescribing module in which clinicians enter medication dosages for inpatient and outpatient orders. The current design validates only that the dosage field contains a numeric value. Which additional input control would BEST reduce the risk of a harmful dosage being prescribed?

A. A check digit validation applied to the patient identification number entered with each new electronic prescription B. A reasonableness check against drug-specific dosage ranges that requires a justified clinician override C. A completeness check confirming that every mandatory prescription field is populated before submission D. A sequence check confirming that prescription numbers are issued without gaps or duplicate values

Question 9

A financial technology lender is designing a machine learning engine that will automatically approve or decline consumer loan applications submitted online. The IS auditor is evaluating the proposed control design for these automated decisions before development begins. Which control is MOST important to include in the design?

A. Encryption of the historical training data set while it is stored and processed in the data science environment B. An attestation from the model vendor confirming the accuracy rate achieved during model training C. Routing of decisions outside defined policy or confidence thresholds to human review, with drift monitoring D. Documentation of the model's architecture, features, and data flows in the enterprise architecture repository

Question 10

While reviewing role design for a new ERP procurement module before go-live, an IS auditor finds that one role allows the same user to create vendors and approve vendor payments. The project manager states that roles will be corrected after launch to protect the schedule. What should the IS auditor do NEXT?

A. Report the conflict to the steering committee and recommend it be resolved in role design before go-live B. Redesign the procurement roles for the project team so that the conflicting permissions are separated C. Record the conflict as an item to be verified during the post-implementation review of the system D. Recommend monthly review of vendor master changes after go-live as the permanent mitigating control

Related Posts

Leave a Comment Cancel Reply