CISA Domain 2A-5 Practice Test 002

This practice test covers Domain 2 (Governance & Management of IT) Subdomain A-5 (Enterprise Risk Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2A-5 Enterprise Risk Management Practice Test 002

10 questions • Single best answer

Question 1

An audit manager at a mid-sized insurance company is planning the first audit of the enterprise risk management (ERM) program. The chief risk officer has provided the current risk register, a heat map, and last year's board risk report. What should the audit manager do FIRST?

A. Select a sample of high-rated risks from the register and test the related mitigating controls B. Obtain the approved ERM framework and risk appetite to understand the criteria the program must meet C. Compare the heat map ratings against industry loss data to assess whether risk scores are reasonable D. Interview business unit leaders to identify significant risks that are missing from the current register

Question 2

During an ERM audit at a state transportation agency, the IS auditor reviews ten risk acceptance forms for high-rated IT risks. All forms are complete and dated, but eight were signed by the IT infrastructure manager, whose delegated authority is limited to low and moderate risks. Which finding is MOST significant?

A. Acceptance forms do not include a planned date for re-evaluating each accepted risk B. Accepted risks are not cross-referenced to the related entries in the enterprise risk register C. The acceptance forms lack a quantified estimate of potential loss for each accepted risk D. High-rated risks were accepted by an individual lacking the authority required by policy

Question 3

A retail bank's ERM policy requires that risk assessment results inform IT investment and project decisions. The IS auditor wants to determine whether the program is operating as intended in practice rather than merely existing on paper. Which of the following provides the BEST evidence?

A. Steering committee minutes showing funding decisions that reference specific risk register entries B. A signed attestation from the chief risk officer confirming risk results are considered in decisions C. The ERM policy and procedure manual approved by the board risk committee during the past year D. A completed risk register showing that every IT risk has an assigned owner and a current rating

Question 4

A telecommunications provider has defined key risk indicators (KRIs) for its critical IT services, each with an escalation threshold. The IS auditor finds that the KRI for unpatched critical vulnerabilities exceeded its threshold for four consecutive months, yet the monthly risk committee reports show the indicator as green. Which recommendation is MOST appropriate?

A. Lower the KRI threshold so that deteriorating conditions are flagged earlier in the reporting cycle B. Replace the vulnerability KRI with a key performance indicator that tracks patch deployment volume C. Automate KRI reporting from source data and require documented escalation of threshold breaches D. Have internal audit review and approve the monthly KRI dashboard before it is sent to the committee

Question 5

An IS auditor at a hospital network reviews the enterprise risk register and notes that each IT risk shows an inherent likelihood and impact score. The register has no fields for existing controls or residual risk, although the board-approved risk appetite is expressed in residual terms. Which conclusion is MOST appropriate?

A. Management cannot reliably determine whether current IT risk exposure is within the approved appetite B. The register overstates exposure, so remediation funding is likely being allocated to lower-priority risks C. Inherent ratings are acceptable because they present the most conservative view of IT risk to the board D. The ERM program is ineffective because it fails to comply with a recognized risk management framework

Question 6

A logistics company decided to address ransomware risk primarily by purchasing a cyber insurance policy, and the risk register now shows the risk as transferred with low residual exposure. The IS auditor confirms the policy is active and coverage limits exceed estimated recovery costs. What is the auditor's GREATEST concern?

A. The insurance premium may rise significantly at renewal if the company files a ransomware claim B. The policy was purchased without obtaining competitive quotes from multiple insurance carriers C. The risk owner has not documented the rationale for choosing risk transfer over risk mitigation D. Insurance does not address operational disruption, reputational harm, or accountability for the risk

Question 7

During an audit of a university's ERM program, the IS auditor learns that several academic departments have begun using generative AI tools to process student records. The enterprise risk register was last refreshed eighteen months ago and contains no AI-related risks. What should the IS auditor do FIRST?

A. Recommend that the university suspend departmental use of AI tools until an assessment is completed B. Determine whether the ERM process includes a mechanism for identifying and assessing emerging risks C. Perform a privacy review of the AI tools to evaluate how student records are stored and processed D. Report to the audit committee that the risk register is incomplete and should be updated immediately

Question 8

A multinational consumer goods company allows each regional business unit to assess IT risk independently. The IS auditor finds that regions use different rating scales, risk categories, and likelihood definitions, and the group risk function manually combines the results for the board. Which recommendation is MOST appropriate?

A. Require each region to appoint a dedicated risk officer who reports directly to the chief risk officer B. Centralize all IT risk assessment activities within the group risk function to remove regional variation C. Establish a common risk taxonomy and rating methodology that all regions must apply consistently D. Implement a governance, risk, and compliance tool to automate consolidation of the regional results

Question 9

The chief executive of a regional credit union asks the head of internal audit to take ownership of the enterprise risk register, including assigning ratings and approving risk treatment plans. The organization has no dedicated risk management function. What is the head of internal audit's BEST course of action?

A. Accept the request, since internal audit already has the most complete view of organizational risk B. Decline all involvement in ERM activities to preserve independence for future assurance engagements C. Accept the role temporarily while arranging for an external firm to audit the ERM program each year D. Offer advisory support to build the process while management retains ownership of risk decisions

Question 10

During post-audit follow-up at an e-commerce company, the IS auditor finds that a prior finding on inadequate database encryption has not been remediated. The IT director states that management decided to accept the risk because remediation costs exceed the expected benefit. What should the IS auditor do NEXT?

A. Verify that the acceptance was formally approved at the appropriate level and recorded in the register B. Escalate the unremediated finding to the audit committee as an overdue corrective action item C. Reperform the cost-benefit analysis to confirm whether remediation costs truly exceed the benefit D. Close the finding, since management has the authority to decide how organizational risk is treated

Related Posts

Leave a Comment Cancel Reply