CISA Domain 3A-1 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A-1 (Project Governance and Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3A-1 Project Governance and Management Practice Test 002

10 questions • Single best answer

Question 1

A state transportation agency's internal audit manager reviews governance of a $60 million toll system replacement. Monthly reports to the steering committee have shown green status for six months, yet the project's earned value data shows a schedule performance index of 0.78 and a cost performance index of 0.85. Which finding is MOST significant?

A. The project is currently behind schedule and over budget relative to its approved baseline plan. B. The project manager has not yet requested additional contingency funding from the sponsor. C. The steering committee is relying on status reporting that does not reflect objective performance data. D. The agency has not benchmarked the project's performance indices against comparable transportation projects.

Question 2

An IS auditor at a regional credit union reviews a core banking upgrade that uses a stage-gate methodology. The project entered the build phase after the executive sponsor gave verbal approval, although the design gate review had not been held and several design deliverables remained in draft. What is the MOST appropriate recommendation?

A. Hold the design gate review and record formal approval before further build work proceeds. B. Require the sponsor to confirm the verbal approval by email to create an audit trail. C. Allow build work to continue and review the draft design deliverables at the next gate. D. Update the methodology to permit sponsor waivers of gate reviews whenever delivery schedules are tight.

Question 3

During an audit of a cloud data platform project at a pharmaceutical distributor, the project manager states that project risks are actively managed. The risk register lists 42 risks, each with an owner, rating, and planned response. Which of the following provides the BEST evidence that risk management is operating effectively?

A. The risk register is stored in the approved project repository with version history enabled. B. The project manager confirms in an interview that the register is reviewed every week. C. Every risk in the register has an assigned owner, a likelihood rating, an impact rating, and a response. D. Steering committee minutes show risk reviews, approved responses, and tracked completion of actions.

Question 4

A hospital system's electronic health record optimization project has absorbed 14 scope changes since approval. The IS auditor finds that the project manager approved each change directly, and none included an assessment of impact on cost, schedule, or expected benefits. Which risk is MOST significant from a project governance perspective?

A. Project documentation may not reflect the final set of delivered system requirements. B. The project may drift from its approved business case without sponsor awareness or approval. C. Clinical users may resist the system if requested changes are rejected by the project manager. D. The testing team may lack sufficient time to update test scripts for each approved change.

Question 5

An insurance company closed its claims automation project after go-live, and the project team was reassigned. Six months later, an IS auditor finds that no one is measuring whether the projected 25% reduction in claims processing time has been achieved. Which recommendation is MOST appropriate?

A. Assign the business sponsor accountability for tracking benefits against the approved business case. B. Reassemble the original project team to measure current processing times and report on the results. C. Ask the IT department to add claims processing time metrics to its monthly service report. D. Include a benefits realization section in the closure templates used for future projects.

Question 6

A municipal government engages a systems integrator on a time-and-materials basis to implement a permitting system. The IS auditor finds that the project manager approves all vendor invoices, and invoiced hours are not reconciled to approved timesheets or accepted deliverables. Which control would BEST address this weakness?

A. Convert the remaining contract work to a fixed-price arrangement with the systems integrator. B. Require the finance department to verify invoice arithmetic before releasing any payment. C. Have the steering committee approve all vendor invoices exceeding a defined monetary threshold. D. Reconcile invoiced hours to approved timesheets and accepted deliverables before payment.

Question 7

At a national airline, a crew scheduling system project is six weeks behind schedule, and the regulatory go-live date cannot move. The project manager plans to cut user acceptance testing from four weeks to one week and has not informed the steering committee. What is the IS auditor's BEST course of action?

A. Recommend that the project manager defer go-live until the full testing period can be completed. B. Perform independent testing of the high-risk scheduling functions to compensate for the shorter cycle. C. Communicate the increased implementation risk to the sponsor and steering committee for a decision. D. Document the reduced testing period as a finding in the post-implementation review report.

Question 8

A global logistics firm runs three concurrent projects that each modify the customer master data structure. Each project has its own steering committee, and the IS auditor finds conflicting design decisions and duplicated data migration effort. Which recommendation would MOST effectively address the root cause?

A. Assign a single data architect to review design documents produced by all three projects. B. Establish program-level governance to manage dependencies and decisions across the projects. C. Require each steering committee to share its meeting minutes and decisions with the other two committees. D. Sequence the projects so that only one modifies customer master data at any given time.

Question 9

A telecommunications provider's billing replacement project has spent $18 million of a $20 million budget, and revised estimates show another $15 million is needed. Some executives argue the project must continue because so much has already been invested. On what basis should the steering committee MOST appropriately decide whether to continue?

A. The proportion of planned deliverables completed to date relative to the original baseline. B. The total amount already invested compared with the full cost of starting a new replacement project. C. The vendor's contractual commitment to deliver the remaining scope at the revised estimate. D. An updated business case comparing remaining costs and risks with the benefits still achievable.

Question 10

A fintech startup delivers its mobile lending app using Scrum, and the board asks internal audit whether project governance is effective. Velocity charts are strong, but the product owner lacks authority to prioritize the backlog, and features are often reprioritized by the CEO between sprints. Which conclusion is MOST appropriate?

A. Governance is weakened because decision rights over scope and priorities are not clearly assigned. B. Governance is effective because velocity trends show the team is delivering work consistently. C. Governance is weakened because Scrum lacks the formal documentation required for audit evidence. D. Governance is effective because senior leadership is actively involved in backlog decisions.

Related Posts

Leave a Comment Cancel Reply