CISA Domain 1B-2 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-2 (Audit Testing and Sampling Methodology) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-2 Audit Testing and Sampling Methodology Practice Test 002

10 questions • Single best answer

Question 1

An external audit team is reviewing a government agency's grant disbursement system, where every configuration change must be approved before deployment. The engagement partner wants a supportable conclusion on whether the approval control operated effectively across the entire fiscal year. Which testing approach is MOST appropriate for reaching that conclusion?

A. Variable sampling to estimate the total monetary value of changes deployed without documented approval B. Analytical review comparing monthly change volumes against prior-year deployment trends and budgets C. Attribute sampling to estimate the rate of unapproved changes across the population D. Judgmental selection of the highest-risk changes deployed during the final quarter of the year

Question 2

A junior IS auditor at an insurance company plans to select a sample of vendor payments from a listing produced by a business analyst using a custom database query. The audit supervisor questions whether the listing can serve as the sampling frame. What should the auditor do FIRST before selecting the sample?

A. Verify the completeness and accuracy of the listing used to define the population B. Increase the planned sample size to compensate for records that may be missing C. Obtain written confirmation from the accounts payable manager that the listing is complete D. Stratify the listing so that high-value payments are separated from routine items

Question 3

An IS auditor tested user provisioning approvals at a logistics firm using a statistical sample of sixty records. After investigating the cause, the auditor confirmed the deviations are systemic and the projected deviation rate substantially exceeds the tolerable rate. Management asks that the control still be treated as effective pending planned remediation. What is the auditor's BEST course of action?

A. Defer the conclusion and retest the control once management completes its planned remediation work B. Report the deviations as exceptions while retaining the planned level of reliance on the control C. Lower the confidence level applied to the sample so the projected results fall within tolerable limits D. Conclude the control cannot be relied upon and expand substantive testing accordingly

Question 4

During a fraud-focused review at a municipal utility, an IS auditor must obtain high confidence of detecting at least one duplicate vendor payment if any such activity exists, even where the occurrence rate would be extremely low. The audit committee has requested strong assurance on this specific concern. Which sampling technique BEST supports this objective?

A. Stratified variable sampling applied across the full population of vendor disbursements B. Discovery sampling C. Stop-or-go sampling designed to minimize the number of items examined D. Monetary unit sampling weighted toward the largest vendor payments in the period

Question 5

An audit manager reviews a staff auditor's revised test plan for change approvals at a manufacturing company. The revision raises the confidence level from ninety to ninety-five percent and lowers the tolerable deviation rate, while the originally calculated sample size remains unchanged. Which conclusion is MOST appropriate for the manager to reach?

A. The sample size should decrease because the expected deviation rate was also reduced B. The sample size remains acceptable provided the selection method is random and unbiased C. The sample size should increase to support the higher confidence and tighter tolerance D. The sample size is not a relevant consideration when nonstatistical sampling is applied

Question 6

A healthcare provider's internal audit team is examining whether recorded patient revenue balances are accurate and complete for the reporting period. The engagement objective is assurance over the reported amounts themselves rather than over how the supporting controls operated. Which procedure BEST satisfies this substantive objective?

A. Recalculating patient billing totals and reconciling the results to the general ledger B. Inspecting a sample of billing system access approval forms for required signatures C. Reviewing the revenue cycle policy to confirm that authorization steps are defined D. Observing supervisors as they sign off on the daily billing batch reconciliation reports

Question 7

An IS auditor at a payment processor obtains the complete settlement transaction file and uses analytics software to test every record against authorization criteria. A staff member asks how testing the full population affects the engagement's sampling considerations and the reliability of the resulting conclusions. Which conclusion is MOST appropriate?

A. Sampling remains necessary because analytics cannot address nonsampling risk in the data B. Sampling risk is eliminated, but the completeness of the data must still be validated C. Full-population testing removes the need for any further substantive procedures in this area D. Statistical projection of exceptions is still required to estimate the population error rate

Question 8

During a substantive review of accounts payable at an energy company, an IS auditor observes that a small group of disbursements represents most of the total value, while thousands of low-value payments comprise the remainder. The auditor must estimate the monetary accuracy of the balance. Which sampling approach BEST addresses this population characteristic?

A. Apply systematic interval selection uniformly across the complete disbursement file B. Raise the confidence level to compensate for the wide dispersion of payment values C. Use attribute sampling to measure the rate of unsupported disbursements in the file D. Stratify the population by value and sample each stratum separately

Question 9

Follow-up work at a regional bank reveals that a privileged access review control failed repeatedly during the period an IS auditor tested it, even though the auditor's statistical sample contained no deviations and the control was reported as effective. Review confirms the testing procedure was properly designed and correctly performed. Which risk MOST likely materialized?

A. Sampling risk, because the sample supported a conclusion the population does not B. Nonsampling risk, because an inappropriate testing procedure was selected and applied C. Control risk, because the control environment deteriorated after the testing period ended D. Detection risk, because insufficient substantive analytical procedures were performed

Question 10

An IS auditor testing batch job authorization at a telecommunications provider identifies two deviations in a sample of sixty items. Both deviations occurred within a two-week window immediately following an upgrade to the scheduling platform. What should the auditor do BEFORE concluding on the control's operating effectiveness?

A. Treat the deviations as anomalies and exclude them from the projected deviation rate B. Report the control as ineffective for the entire period covered by the audit scope C. Evaluate the nature and cause of the deviations before projecting the sample results D. Draw a supplemental sample limited to transactions processed after the platform upgrade

Related Posts

Leave a Comment Cancel Reply