Skip to content

CISA - Certified Information Systems Auditor - Practice Questions

15 questions across the five CISA domains: the information systems auditing process, governance and management of IT, acquisition and development and implementation, operations and business resilience, and protection of information assets.

CISA questions reward the auditor's mindset. The correct answer is usually the one about evidence, independence, and process rather than the one about fixing the problem yourself.

Cert page: exams/isaca/cisa/

Question 1

Scenario: An auditor discovers a control deficiency during fieldwork.

A. Fix it immediately yourself and note the fix afterward B. Document the finding with evidence, assess its risk, discuss it with management to confirm the facts, and report it in the audit report C. Ignore it if it is minor, since small deficiencies under the materiality threshold are not reportable D. Report it to the regulator first

Answer **Correct: B** **Why:** Implementing the fix destroys the auditor's independence, because you would later be auditing your own work. The auditor's product is a documented, evidenced finding and a recommendation; remediation belongs to management.

Question 2

Scenario: What is the FIRST step in planning an audit?

A. Understand the business and its risks, then define scope and objectives based on a risk assessment B. Test controls first, so that the auditor can see which areas are weak and then limit the scope of the audit to those control areas C. Write the report D. Select the sample from the transaction population so that the testing can begin as early as possible in the engagement timeline

Answer **Correct: A** **Why:** Risk-based planning is what directs limited audit effort toward what matters. CISA questions asking for the FIRST step almost always want the understanding-and-planning answer rather than a testing activity.

Question 3

Scenario: Which evidence is most reliable?

A. Evidence obtained directly by the auditor from an independent external source B. A policy document approved by senior management, which shows the intended control but not whether it operated in practice C. An internal report generated by the auditee's own system and handed over by the system owner, which the auditor has not independently validated D. A verbal statement from the system owner

Answer **Correct: A** **Why:** Reliability rises with auditor-obtained, external, and objective evidence, and falls with auditee-provided, internal, and verbal evidence. A policy document shows what should happen, not what did, which makes it evidence of design rather than of operation.

Question 4

Scenario: An auditor must test whether a control operated throughout the year, not just today.

A. An inquiry of the control owner, who describes how the control runs each period and confirms that it was performed on every occasion B. A walkthrough of one transaction from start to finish, which confirms the design of the control but not that it operated throughout the year C. Observation of the control being performed on one day during fieldwork, which shows it works that day but says little about the other days D. A test of operating effectiveness over a sample of the period, using attribute sampling with a defined confidence level

Answer **Correct: D** **Why:** A walkthrough tests design, sampling across the period tests operation. Sample size follows from the population, tolerable deviation rate, and confidence level, which is why the statistical basis matters rather than picking a round number.

Question 5

Scenario: Segregation of duties cannot be achieved in a small IT team.

A. Hire more staff to separate every duty, which may be unaffordable for a small team B. Recommend compensating controls: supervisory review, detailed logging with independent log review, and reconciliation C. Report it as a critical failure with no alternative, because segregation of duties is mandatory in every environment regardless of the size of the team D. Accept the risk silently without raising it, since the team is small and trusted

Answer **Correct: B** **Why:** Compensating controls are the standard answer where a preventive control is infeasible. The residual risk still has to be documented and accepted by management at an appropriate level, rather than quietly absorbed by the audit.

Question 6

Scenario: Which control type is a detective control?

A. Encryption of data at rest and in transit, which protects confidentiality by making data unreadable but does not identify problems after the fact B. Log review and reconciliation, which identify problems after they occur C. Segregation of duties, which prevents one person from completing a sensitive transaction alone by splitting the steps between several people D. An access control list on the file server, which blocks users who are not named before they reach the data

Answer **Correct: B** **Why:** Preventive controls stop an event, detective controls find it, corrective controls restore. Detective controls only have value if someone acts on what they detect, which is why "logs are collected" is a weaker finding response than "logs are reviewed."

Question 7

Scenario: A change was moved to production without approval.

A. A minor issue that can be closed with a note, because the change was eventually approved after the fact by the change manager B. Reverse the change immediately, since an unapproved change must be backed out regardless of its effect on the production service C. A control failure in change management; assess whether it is isolated or systemic by testing a sample of other changes D. Ignore it if the change worked

Answer **Correct: C** **Why:** A single exception may be an anomaly or the visible part of a broken process, and the difference determines the finding's severity. Expanding the sample to establish which is the auditor's next action, not remediation.

Question 8

Scenario: A business continuity plan exists but has never been tested.

A. Rewrite the plan with updated contact lists and recovery steps, which improves the document but does not show that the plan works in practice B. Testing is optional for a plan that was approved by the board and reviewed each year, as long as backups are taken regularly C. An untested plan provides limited assurance; recommend testing appropriate to criticality, from walkthrough to full interruption test D. It is adequate because a documented, approved plan satisfies the requirement and a test would only disrupt normal operations

Answer **Correct: C** **Why:** Testing is what turns a document into a capability, and it is where unrecorded dependencies surface. The test type escalates with criticality: checklist, walkthrough, simulation, parallel, then full interruption.

Question 9

Scenario: Which metric defines the maximum acceptable data loss?

A. RPO, the recovery point objective B. MTD, the maximum tolerable downtime, which sets how long the business can be without the process before the harm becomes unacceptable C. RTO, the recovery time objective, which sets how quickly a service must be restored after an incident and not how much data may be lost D. MTBF, the mean time between failures, which measures how often a component is expected to fail and not recovery goals

Answer **Correct: A** **Why:** RPO is measured backwards from the incident and drives backup and replication frequency; RTO is measured forwards and drives recovery capability. The maximum tolerable downtime bounds the RTO, and the two are frequently confused in exam wording.

Question 10

Scenario: An auditor is asked to audit a system they helped design last year.

A. Decline all work with that client for the rest of the engagement cycle, even for areas of the audit unrelated to the system the auditor helped build B. Note it in the report only, as a footnote, and continue with the audit so that the work is not delayed or reassigned to another auditor C. Proceed as normal, since a year has passed and the design work was done before this audit engagement was formally accepted D. Disclose the impairment to independence and have someone else perform that portion of the audit

Answer **Correct: D** **Why:** Independence in both fact and appearance is the profession's foundation, and self-review is the classic impairment. Disclosure plus reassignment is the standard remedy under the ISACA code of professional ethics.

Question 11

Scenario: Sampling finds 3 exceptions in a sample of 60 from a population of 6,000.

A. Test the whole population of 6,000 items, which would settle the question but is rarely cost effective when sampling has already been planned B. Conclude there are exactly 300 exceptions in the population, treating the sample rate as precise C. Project the deviation rate to the population, compare it against the tolerable rate, and consider extending testing before concluding D. Ignore the exceptions because 3 of 60 is a small number and sampling results are only indicative

Answer **Correct: C** **Why:** A sample supports an inference with a confidence interval, not a point count. Whether the projected rate exceeds the tolerable rate is what decides the conclusion, and exceptions also warrant asking whether they share a root cause.

Question 12

Scenario: An organization outsources payroll processing to a third party.

A. Audit the provider directly every year, because the organization cannot rely on any report prepared by another auditor about the third party B. Accountability remains with the organization; obtain assurance through a service auditor's report such as SOC 1 or SOC 2 and review complementary user entity controls C. Risk transfers entirely to the provider once the contract is signed, so the organization needs only to track the service level targets D. No audit is required as the contract with the provider already contains data protection and breach notification clauses

Answer **Correct: B** **Why:** Outsourcing shifts the activity, not the accountability. Complementary user entity controls are the part most often skipped: the report's conclusions only hold if the customer implements the controls it assumes.

Question 13

Scenario: Which control best addresses the risk of privileged account misuse?

A. Privileged access management with checkout, session recording, and independent review of privileged activity B. Password complexity rules requiring long passwords, which do not monitor what a privileged user does C. Account lockout D. Annual access reviews of all accounts by line managers, which catch stale entitlements once a year but not misuse between reviews

Answer **Correct: A** **Why:** Privileged users can often alter the very logs that would show misuse, which is why independent review and tamper-resistant recording matter more than credential strength. Annual reviews are too infrequent to be the primary control here.

Question 14

Scenario: An audit report finding is disputed by management.

A. Remove the finding once management disputes it, to keep the relationship with the client B. Escalate to the board immediately, bypassing management and the audit committee process C. Re-examine the evidence; if the finding stands, report it with management's response included alongside the auditor's recommendation D. Soften the wording of the finding so that management can accept it

Answer **Correct: C** **Why:** Including management's response is standard practice and lets the reader weigh both positions. Removing or softening a supported finding compromises the audit's integrity, while immediate escalation skips a legitimate step in the process.

Question 15

Scenario: Which is the strongest evidence that a data center's physical access control works?

A. The policy document describing the badge procedures, approved by the security manager, which shows the intended rules but not how they are applied B. A photograph of the badge reader C. An interview with the facilities manager, who describes how access is granted and reviewed, which is inquiry and the weakest form of evidence D. Observation combined with testing the access log against the authorized personnel list for the period

Answer **Correct: D** **Why:** Reconciling actual entries against authorization tests operation over time, while observation confirms the control exists as described. Comparing the two also catches badges belonging to leavers, which is the usual finding.

Where to go deeper