ISACA CISA QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Information Systems Auditing Process (Questions 1–20)
1. Which of the following is the PRIMARY objective of an IS audit?
A) To detect all fraud within an organization
B) To provide assurance that IT controls are adequate and effective
C) To recommend new technologies
D) To evaluate employee performance
Answer: B
Rationale: The primary objective of an IS audit is to provide independent assurance that information systems
controls are adequate to protect assets, maintain data integrity, and achieve organizational goals effectively.
Detecting all fraud (A) is not realistic or the primary objective. Recommending technology (C) and evaluating
employees (D) are not audit objectives.
2. An IS auditor is planning an audit engagement. The FIRST step should be to:
A) Develop the audit program
B) Conduct a risk assessment
,C) Perform substantive testing
D) Issue the audit report
Answer: B
Rationale: Risk assessment is the first step in audit planning because it determines the scope, objectives, and
resource allocation. The audit program (A) is developed after risk assessment. Substantive testing (C) occurs
during fieldwork. The audit report (D) is issued at the end.
3. Which type of audit evidence is considered MOST reliable?
A) Management representations
B) Auditor's physical observation
C) Internal documentation
D) Verbal statements from IT staff
Answer: B
, Rationale: Evidence obtained directly by the auditor through physical observation, inspection, or computation is
more reliable than evidence obtained indirectly. Management representations (A), internal documentation (C),
and verbal statements (D) are less reliable because they originate from the auditee.
4. In audit sampling, the risk that the auditor concludes a control is effective when it is not is called:
A) Detection risk
B) Inherent risk
C) Control risk
D) Sampling risk (beta risk)
Answer: D
Rationale: Sampling risk (beta risk) is the risk that the auditor's conclusion based on a sample differs from the
conclusion based on the entire population. Specifically, concluding a control is effective when it is not is a form of
sampling risk. Detection risk (A) relates to failing to detect a material error. Inherent risk (B) is the risk before
controls. Control risk (C) is the risk that controls fail to prevent/detect errors.
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Information Systems Auditing Process (Questions 1–20)
1. Which of the following is the PRIMARY objective of an IS audit?
A) To detect all fraud within an organization
B) To provide assurance that IT controls are adequate and effective
C) To recommend new technologies
D) To evaluate employee performance
Answer: B
Rationale: The primary objective of an IS audit is to provide independent assurance that information systems
controls are adequate to protect assets, maintain data integrity, and achieve organizational goals effectively.
Detecting all fraud (A) is not realistic or the primary objective. Recommending technology (C) and evaluating
employees (D) are not audit objectives.
2. An IS auditor is planning an audit engagement. The FIRST step should be to:
A) Develop the audit program
B) Conduct a risk assessment
,C) Perform substantive testing
D) Issue the audit report
Answer: B
Rationale: Risk assessment is the first step in audit planning because it determines the scope, objectives, and
resource allocation. The audit program (A) is developed after risk assessment. Substantive testing (C) occurs
during fieldwork. The audit report (D) is issued at the end.
3. Which type of audit evidence is considered MOST reliable?
A) Management representations
B) Auditor's physical observation
C) Internal documentation
D) Verbal statements from IT staff
Answer: B
, Rationale: Evidence obtained directly by the auditor through physical observation, inspection, or computation is
more reliable than evidence obtained indirectly. Management representations (A), internal documentation (C),
and verbal statements (D) are less reliable because they originate from the auditee.
4. In audit sampling, the risk that the auditor concludes a control is effective when it is not is called:
A) Detection risk
B) Inherent risk
C) Control risk
D) Sampling risk (beta risk)
Answer: D
Rationale: Sampling risk (beta risk) is the risk that the auditor's conclusion based on a sample differs from the
conclusion based on the entire population. Specifically, concluding a control is effective when it is not is a form of
sampling risk. Detection risk (A) relates to failing to detect a material error. Inherent risk (B) is the risk before
controls. Control risk (C) is the risk that controls fail to prevent/detect errors.
