CISA Domain 1B-4 Practice Test 002

This practice test covers Domain 1 (Information Systems Auditing Process) Subdomain B-4 (Audit Data Analytics) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 1B-4 Audit Data Analytics Practice Test 002

10 questions • Single best answer

Question 1

An external audit firm is engaged to review a public university's student financial aid disbursements. The engagement partner proposes analyzing the full disbursement population with data analytics rather than relying on attribute sampling. Before designing any analytics routines, what should the IS auditor do FIRST?

A. Select the analytics software best suited to the disbursement system's database platform B. Define the audit objectives and the specific risks the analytics are intended to address C. Request read-only access to the production database to extract the complete population D. Develop exception thresholds based on prior-year disbursement volumes and error rates

Question 2

An IS auditor at a regional credit union receives a loan-origination extract from IT for full-population testing. The file contains 48,210 records, and the auditor plans to run duplicate-loan and approval-limit override tests. Which step BEST ensures that conclusions drawn from the analytics will be reliable?

A. Having the IT manager sign a statement that the extract was produced from production B. Running the planned tests on a small subset first to confirm that the scripts execute C. Reviewing the extract's field layout against the data dictionary provided by the vendor D. Reconciling record counts and control totals in the extract to the source system reports

Question 3

During a data analytics review of a telecommunications company's billing system, an IS auditor's script flags 1,150 customer accounts receiving discounts above the approved rate table. The billing manager asserts that most of these are legitimate promotional overrides approved by sales leadership. What is the auditor's BEST course of action?

A. Validate a risk-based selection of exceptions against supporting approvals before concluding B. Report all 1,150 exceptions as control failures because they breach the approved rate table C. Accept the manager's explanation and adjust the script to exclude promotional override codes D. Expand the analytics to the prior two years to establish whether the pattern is recurring

Question 4

A multinational manufacturer's internal audit function plans to deploy continuous auditing scripts that run nightly against the ERP's purchase-to-pay module. Management's finance team already operates its own continuous monitoring dashboards over the same vendor, invoice, and payment transactions. Which consideration is MOST important in positioning internal audit's routines?

A. Internal audit's scripts should replicate management's dashboards to ensure consistent results B. Management's dashboards should be retired once internal audit's routines are fully operational C. Internal audit's routines should provide independent assurance without assuming control ownership D. Continuous auditing results should go to process owners before being shared with the audit committee

Question 5

An audit manager reviewing working papers for a pharmacy benefits company's claims audit notices that a staff auditor wrote a new SQL query to identify duplicate claim payments. The query returned zero exceptions across 2.3 million records paid during the audit period. What should the audit manager do FIRST?

A. Accept the result because full-population testing gives more assurance than sampling B. Verify the query logic by testing it against data containing known duplicate payments C. Ask IT to independently rerun the same query directly on the production claims database D. Document the zero-exception result and conclude that duplicate-payment controls are effective

Question 6

An IS auditor at a government tax agency plans to download a full year of taxpayer refund records to an audit laptop for analysis with generalized audit software. The records include taxpayer identification numbers and bank account details. Which action is MOST appropriate before the extract is obtained?

A. Confirm data handling requirements and mask or exclude sensitive fields not needed for testing B. Obtain written approval from the agency's IT director for the download to the audit laptop C. Verify that the laptop's full-disk encryption is enabled and that the audit software is patched D. Arrange for the agency's own data team to perform the analysis so no data leaves the system

Question 7

During an audit of an online retailer's accounts payable process, an IS auditor wants to determine whether any employees both created vendor records and approved payments to those vendors. The ERP retains user IDs for all master data changes and payment approvals. Which analytics approach would provide the BEST evidence?

A. Stratify payments by amount and review approvals for the highest-value vendor payments B. Apply Benford's Law to payment amounts to detect anomalies suggesting manipulated entries C. Compare vendor bank account numbers to the employee payroll master file for any matches D. Join vendor master change logs with payment approval logs and match on common user IDs

Question 8

A logistics company's IS auditor applies data analytics to fuel-card transactions and finds 37 purchases made on weekends by drivers recorded as off duty. The total value is immaterial, but three cards account for most of the transactions. Which conclusion is MOST appropriate based on the evidence?

A. The finding should be excluded from the report because the total amount is immaterial B. The fuel-card control is ineffective, and all cards should be suspended pending review C. The pattern indicates possible misuse that warrants further investigation and reporting D. The analytics results confirm fraud and should be referred directly to law enforcement

Question 9

An IS auditor at an asset management firm requests trade-allocation data for analytics testing. Because of access restrictions, the trading operations team offers to run the auditor's queries itself and email the results in spreadsheets. Which approach BEST preserves the reliability of the audit evidence?

A. Observe the queries being executed and obtain the outputs directly from the system B. Accept the spreadsheets once the trading operations manager signs off on accuracy C. Compare the spreadsheet totals with figures in the monthly management reporting pack D. Rerun the queries later on a backup copy of the database restored by IT operations

Question 10

An audit manager at a national airline is preparing next year's IS audit plan with limited staff to cover 40 auditable entities. The chief audit executive asks how data analytics could add the most value during the planning phase. Which use of analytics is MOST appropriate?

A. Replacing the annual risk assessment with automated scoring based on transaction volumes B. Analyzing key risk indicators across entities to prioritize areas for audit coverage C. Running full-population testing on every entity to eliminate the need for sampling D. Automating fieldwork test scripts for the entities that were rated low risk last year

Related Posts

Leave a Comment Cancel Reply