CISA Domain 1A-1 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain A-1 (IS Audit Standards, Guidelines, and Codes of Ethics) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1A-1 IS Audit Standards, Guidelines, and Codes of Ethics Practice Test 002

10 questions • Single best answer

Question 1

An external audit firm assigns an IS auditor to review a manufacturing client's inventory management system. The auditor designed and configured that system's access control module while employed by the client two years earlier. According to the IS audit code of professional ethics, what should the auditor do FIRST?

A. Disclose the prior involvement to audit management for an independence assessment B. Withdraw from the engagement and request reassignment to a different client C. Proceed with the review, since the prior configuration work ended over two years ago D. Limit testing to areas unrelated to the access control module once built

Question 2

A quality reviewer examines a completed IS audit engagement file and finds that the team departed from a practice described in an IS auditing guideline. All applicable IS audit standards were followed, and the departure is documented with a stated rationale. Which conclusion is MOST appropriate regarding the engagement's compliance?

A. The engagement is noncompliant because guidelines are mandatory for all audit work B. The engagement complies, as guidelines provide direction that auditors should consider C. The engagement requires a qualified opinion reflecting the documented departure D. The engagement complies only if the audit committee formally approved the departure beforehand

Question 3

Midway through a cloud services review at a healthcare organization, the CIO instructs the IS auditor not to test third-party administrator accounts, citing vendor confidentiality terms. The auditor considers these accounts material to the planned control conclusion. What is the auditor's BEST course of action?

A. Accept the restriction and record the vendor confidentiality terms in the working papers B. Rely on the vendor's most recent SOC 2 report in place of any direct testing C. Escalate the scope limitation to those charged with governance before continuing D. Issue the report with a disclaimer covering all third-party access controls

Question 4

An internal audit department plans a review of a newly deployed container orchestration platform, but none of its IS auditors have experience with the technology. The audit charter requires all engagements to comply with IS audit standards. Which action BEST demonstrates compliance with the standard on professional competence?

A. Engage a qualified specialist to support the team and supervise the work performed B. Remove the platform from the annual audit plan until staff complete relevant training C. Restrict the review to policy documentation the existing team is able to evaluate D. Have the platform administrators self-assess and let the team review the results

Question 5

While completing a financial services engagement, an IS auditor is contacted by a former colleague at a competing bank who asks about weaknesses observed in the client's payment platform. No separate confidentiality agreement was executed for the engagement. Which principle of the code of professional ethics MOST directly governs the auditor's response?

A. Due professional care in the performance of assigned audit duties B. Objectivity and independence in both appearance and in fact when forming conclusions C. Maintenance of competency through continuing professional education D. Privacy and confidentiality of information obtained during audit duties

Question 6

During substantive testing of vendor master file changes at a government agency, an IS auditor identifies payments routed to a supplier whose bank details match an employee's personal account. The engagement was not scoped as a fraud investigation. What should the IS auditor do FIRST?

A. Interview the employee to determine whether the account match has a valid explanation B. Expand the sample to quantify the total value of all potentially affected payments C. Document the observation and include it in the final engagement report D. Report the matter promptly to the appropriate level of management or governance

Question 7

An IS audit function within an enterprise IT organization reports both administratively and functionally to the CIO, whose environment it audits, and its audit charter was approved by the CIO rather than the board. Which condition represents the MOST significant deficiency against IS audit standards?

A. The audit charter was not independently reviewed by the external audit firm B. Functional reporting to the CIO impairs the organizational independence of the function C. Audit staff may not hold the technical certifications the charter appears to require D. Engagement results are not benchmarked against comparable industry peer audit organizations

Question 8

An IS auditor concludes that change management controls at an insurance company operate effectively, relying solely on a management representation letter and an interview with the change manager. No change records were examined. A quality reviewer challenges the conclusion. Which IS audit standard was MOST likely breached?

A. The standard requiring sufficient and appropriate evidence to support conclusions B. The standard requiring engagement planning to address assessed audit risk and materiality C. The standard requiring timely communication of results to relevant stakeholders D. The standard requiring follow-up on findings reported in prior engagements

Question 9

A newly certified IS auditor is assigned to lead audits of an organization's ERP environment but has not completed any continuing professional education for two years. The audit director is deciding how to staff the upcoming engagement. Which action is MOST consistent with IS audit standards?

A. Assign the engagement and address the education shortfall in the following cycle B. Allow the auditor to lead and defer the education requirement until year end C. Reassign the lead role and require the auditor to obtain the needed competencies D. Reduce the engagement scope to match the auditor's current level of knowledge

Question 10

Following fieldwork at a retail company, senior management disagrees with an IS auditor's finding on privileged access administration and formally requests that it be removed from the final report. The auditor's working papers and test results fully support the finding. Which action BEST aligns with IS audit reporting standards?

A. Remove the finding and track it informally through management's own action plan B. Downgrade the finding's risk rating to reflect management's stated position C. Retain the finding and include management's response within the audit report D. Defer the finding to the next audit cycle for reassessment and confirmation

Related Posts

Leave a Comment Cancel Reply