CISA 2026 Practice Exam – 20-Question Sample with Answers &
Detailed Rationales, IT Auditing, Governance, Systems Acquisition,
IT Operations & Information Asset Protection
Domain 1: Information Systems Auditing Process (18%)
Question 1
An IS auditor is assigned to audit a system that the same auditor helped design six months
prior. Which of the following is the MOST appropriate course of action?
A. Proceed with the audit since technical expertise is essential for accurate assessment.
B. Decline the engagement and recommend that an independent auditor conduct the
review.
C. Conduct the audit but disclose the prior involvement in the final report.
D. Perform only a limited review focusing on areas the auditor did not design.
Correct Answer: B
Explanation: Designing and then auditing the same controls creates a self-review threat that
compromises independence. ISACA standards prohibit auditors from auditing their own
work, regardless of technical expertise.
Question 2
During an audit of a high-volume transaction processing system, the auditor needs to
determine whether a specific control is operating effectively. Which sampling approach BEST
preserves audit defensibility?
A. Judgmental sampling of the largest transactions selected by management.
B. Convenience sampling of transactions processed on a single day.
C. Statistical attribute sampling with parameters based on risk and tolerable deviation rate.
D. Testing 100% of the population to eliminate sampling risk.
,Correct Answer: C
Explanation: Statistical attribute sampling provides mathematical confidence and
defensibility. Sample size is determined by risk, confidence level, and tolerable deviation rate
—not convenience or management selection.
Question 3
An IS auditor observes that the badge reader at a data center entrance functions properly.
Which of the following represents the MOST reliable audit evidence regarding access control
effectiveness?
A. The auditor's direct observation of the badge reader during a site visit.
B. System-generated access logs for the audit period validated against HR termination
records.
C. The IT manager's written assurance that access controls are enforced.
D. Vendor documentation describing the badge system's technical specifications.
Correct Answer: B
Explanation: System-generated logs corroborated with independent HR data rank highest in
evidence reliability. Auditor observation is limited to a point in time; management assertions
and vendor documents are weaker evidence.
Question 4
An auditor discovers that a significant control weakness exists in the accounts payable
system. What is the auditor's FIRST appropriate action?
A. Immediately notify the media to ensure public accountability.
B. Document the finding and validate the issue through additional testing before reporting.
,C. Personally implement corrective controls to mitigate the risk.
D. Report the weakness only in the annual audit summary.
Correct Answer: B
Explanation: Auditors must validate findings through evidence before reporting. The
professional sequence is: identify, test, confirm, then communicate. Personal
implementation of controls violates independence.
Question 5
Which of the following BEST describes the primary purpose of a risk-based audit approach?
A. To test every control with equal rigor to ensure comprehensive coverage.
B. To minimize audit costs by reducing the scope of testing.
C. To focus audit resources on areas with the highest potential for material loss or harm.
D. To satisfy regulatory requirements with minimal organizational disruption.
Correct Answer: C
Explanation: Risk-based auditing prioritizes resources where risk is greatest. It is not about
cost minimization or equal testing—it is about directing limited audit capacity to the areas of
highest organizational impact.
Domain 2: Governance and Management of IT (18%)
Question 6
An organization's board has delegated IT oversight to a technology committee, but the CIO
serves as the committee chair. Which governance deficiency should the IS auditor identify as
MOST significant?
A. The absence of a documented IT balanced scorecard.
, B. Insufficient segregation between oversight and execution of IT strategy.
C. The committee meets only quarterly rather than monthly.
D. IT budgets are not aligned with the enterprise capital plan.
Correct Answer: B
Explanation: When the CIO chairs the committee meant to oversee the CIO's own execution,
independence is fundamentally compromised. This is a governance design flaw that
undermines the committee's ability to provide objective oversight.
Question 7
Which of the following is the PRIMARY purpose of an IT steering committee?
A. To ensure that IT projects are technically feasible and properly coded.
B. To prioritize IT investments based on alignment with business strategy.
C. To manage the day-to-day operations of the IT department.
D. To conduct final code reviews before production deployment.
Correct Answer: B
Explanation: IT steering committees consist of senior business and IT stakeholders who
ensure IT investments align with and support enterprise objectives. Operational
management and technical reviews are delegated responsibilities.
Question 8
An IS auditor reviewing an organization's data governance program finds that data owners
have not been formally designated. What is the MOST significant risk?
A. Backup procedures may not be properly executed.
Detailed Rationales, IT Auditing, Governance, Systems Acquisition,
IT Operations & Information Asset Protection
Domain 1: Information Systems Auditing Process (18%)
Question 1
An IS auditor is assigned to audit a system that the same auditor helped design six months
prior. Which of the following is the MOST appropriate course of action?
A. Proceed with the audit since technical expertise is essential for accurate assessment.
B. Decline the engagement and recommend that an independent auditor conduct the
review.
C. Conduct the audit but disclose the prior involvement in the final report.
D. Perform only a limited review focusing on areas the auditor did not design.
Correct Answer: B
Explanation: Designing and then auditing the same controls creates a self-review threat that
compromises independence. ISACA standards prohibit auditors from auditing their own
work, regardless of technical expertise.
Question 2
During an audit of a high-volume transaction processing system, the auditor needs to
determine whether a specific control is operating effectively. Which sampling approach BEST
preserves audit defensibility?
A. Judgmental sampling of the largest transactions selected by management.
B. Convenience sampling of transactions processed on a single day.
C. Statistical attribute sampling with parameters based on risk and tolerable deviation rate.
D. Testing 100% of the population to eliminate sampling risk.
,Correct Answer: C
Explanation: Statistical attribute sampling provides mathematical confidence and
defensibility. Sample size is determined by risk, confidence level, and tolerable deviation rate
—not convenience or management selection.
Question 3
An IS auditor observes that the badge reader at a data center entrance functions properly.
Which of the following represents the MOST reliable audit evidence regarding access control
effectiveness?
A. The auditor's direct observation of the badge reader during a site visit.
B. System-generated access logs for the audit period validated against HR termination
records.
C. The IT manager's written assurance that access controls are enforced.
D. Vendor documentation describing the badge system's technical specifications.
Correct Answer: B
Explanation: System-generated logs corroborated with independent HR data rank highest in
evidence reliability. Auditor observation is limited to a point in time; management assertions
and vendor documents are weaker evidence.
Question 4
An auditor discovers that a significant control weakness exists in the accounts payable
system. What is the auditor's FIRST appropriate action?
A. Immediately notify the media to ensure public accountability.
B. Document the finding and validate the issue through additional testing before reporting.
,C. Personally implement corrective controls to mitigate the risk.
D. Report the weakness only in the annual audit summary.
Correct Answer: B
Explanation: Auditors must validate findings through evidence before reporting. The
professional sequence is: identify, test, confirm, then communicate. Personal
implementation of controls violates independence.
Question 5
Which of the following BEST describes the primary purpose of a risk-based audit approach?
A. To test every control with equal rigor to ensure comprehensive coverage.
B. To minimize audit costs by reducing the scope of testing.
C. To focus audit resources on areas with the highest potential for material loss or harm.
D. To satisfy regulatory requirements with minimal organizational disruption.
Correct Answer: C
Explanation: Risk-based auditing prioritizes resources where risk is greatest. It is not about
cost minimization or equal testing—it is about directing limited audit capacity to the areas of
highest organizational impact.
Domain 2: Governance and Management of IT (18%)
Question 6
An organization's board has delegated IT oversight to a technology committee, but the CIO
serves as the committee chair. Which governance deficiency should the IS auditor identify as
MOST significant?
A. The absence of a documented IT balanced scorecard.
, B. Insufficient segregation between oversight and execution of IT strategy.
C. The committee meets only quarterly rather than monthly.
D. IT budgets are not aligned with the enterprise capital plan.
Correct Answer: B
Explanation: When the CIO chairs the committee meant to oversee the CIO's own execution,
independence is fundamentally compromised. This is a governance design flaw that
undermines the committee's ability to provide objective oversight.
Question 7
Which of the following is the PRIMARY purpose of an IT steering committee?
A. To ensure that IT projects are technically feasible and properly coded.
B. To prioritize IT investments based on alignment with business strategy.
C. To manage the day-to-day operations of the IT department.
D. To conduct final code reviews before production deployment.
Correct Answer: B
Explanation: IT steering committees consist of senior business and IT stakeholders who
ensure IT investments align with and support enterprise objectives. Operational
management and technical reviews are delegated responsibilities.
Question 8
An IS auditor reviewing an organization's data governance program finds that data owners
have not been formally designated. What is the MOST significant risk?
A. Backup procedures may not be properly executed.
