CISA Exam 2026: Certified Information Systems Auditor Practice
Test — Information Systems Auditing, IT Governance, Systems
Acquisition, Operations, Business Resilience & Information Asset
Protection — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
Domain 1: Information Systems Auditing Process (34 Questions)
Question 1
An IS auditor is planning an audit of a third-party service provider that hosts the
organization's customer relationship management system. The auditor has not previously
audited this provider. Which of the following should be the auditor's FIRST step in planning
the engagement?
A. Review the service provider's SOC 2 Type II report.
B. Conduct a risk assessment to determine the scope and objectives of the audit.
C. Obtain a copy of the service level agreement between the organization and the provider.
D. Interview the organization's IT manager about the provider's performance.
Correct Answer: B
Explanation: Risk assessment should precede all other planning activities to properly scope
the audit based on identified risks. Reviewing SOC reports and SLAs follows scope
determination.
Question 2
During an audit of the accounts payable system, an IS auditor discovers that users can
approve payments for vendors they themselves have added to the master file. Which type of
control deficiency does this represent?
,A. Lack of input validation.
B. Inadequate segregation of duties.
C. Insufficient audit trail.
D. Missing reconciliation control.
Correct Answer: B
Explanation: Allowing the same user to create vendors and approve payments creates a
segregation of duties conflict that enables fraudulent payments without detection.
Question 3
An IS auditor is evaluating the adequacy of audit evidence obtained from a database query.
The auditor extracted the data using a tool provided by the database administrator. What is
the PRIMARY concern with this evidence?
A. The data may not be in a readable format.
B. The database administrator could have manipulated the tool or data.
C. The query may not capture all relevant transactions.
D. The extraction process may impact system performance.
Correct Answer: B
Explanation: Evidence obtained through tools controlled by the auditee lacks independence;
the auditor should use their own extraction tools or validate results independently.
Question 4
,An IS auditor has completed fieldwork and identified a high-risk finding related to
unencrypted data transmission. The auditee disagrees with the finding. What should the
auditor do NEXT?
A. Remove the finding from the report since the auditee disagrees.
B. Escalate the disagreement directly to the audit committee.
C. Discuss the finding with the auditee to understand their perspective and provide
supporting evidence.
D. Lower the risk rating to avoid conflict.
Correct Answer: C
Explanation: Professional standards require auditors to discuss disagreements and provide
evidence supporting findings before escalating or modifying conclusions.
Question 5
An IS auditor is assessing the reliability of a system-generated exception report used as audit
evidence. The report is generated by a script written by the system administrator. Which
factor is MOST important in evaluating the evidence?
A. The length of the exception report.
B. Whether the script logic has been independently validated.
C. The format in which the report is presented.
D. The frequency with which the report is generated.
Correct Answer: B
, Explanation: System-generated evidence reliability depends on the integrity of the
generating process; independent validation of script logic confirms the report's
completeness and accuracy.
Question 6
When planning an IS audit engagement, the auditor should consider materiality. In the
context of an IS audit, materiality is BEST described as:
A. The total dollar value of the IT budget.
B. The significance of an omission or misstatement that could influence decisions.
C. The number of systems in scope for the audit.
D. The percentage of IT controls that are automated.
Correct Answer: B
Explanation: Materiality relates to the significance of findings in influencing decisions, not to
budget size or system count.
Question 7
An IS auditor is using statistical sampling to test the operating effectiveness of a control. The
auditor wants to conclude with 95% confidence that the deviation rate is less than 5%. The
sample results show a 3% deviation rate. What should the auditor conclude?
A. The control is operating effectively because the deviation rate is below 5%.
B. The auditor can conclude with 95% confidence that the deviation rate is less than 5%.
C. The sample size should be increased to reach a conclusion.
D. The control is not operating effectively because deviations were found.
Test — Information Systems Auditing, IT Governance, Systems
Acquisition, Operations, Business Resilience & Information Asset
Protection — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
Domain 1: Information Systems Auditing Process (34 Questions)
Question 1
An IS auditor is planning an audit of a third-party service provider that hosts the
organization's customer relationship management system. The auditor has not previously
audited this provider. Which of the following should be the auditor's FIRST step in planning
the engagement?
A. Review the service provider's SOC 2 Type II report.
B. Conduct a risk assessment to determine the scope and objectives of the audit.
C. Obtain a copy of the service level agreement between the organization and the provider.
D. Interview the organization's IT manager about the provider's performance.
Correct Answer: B
Explanation: Risk assessment should precede all other planning activities to properly scope
the audit based on identified risks. Reviewing SOC reports and SLAs follows scope
determination.
Question 2
During an audit of the accounts payable system, an IS auditor discovers that users can
approve payments for vendors they themselves have added to the master file. Which type of
control deficiency does this represent?
,A. Lack of input validation.
B. Inadequate segregation of duties.
C. Insufficient audit trail.
D. Missing reconciliation control.
Correct Answer: B
Explanation: Allowing the same user to create vendors and approve payments creates a
segregation of duties conflict that enables fraudulent payments without detection.
Question 3
An IS auditor is evaluating the adequacy of audit evidence obtained from a database query.
The auditor extracted the data using a tool provided by the database administrator. What is
the PRIMARY concern with this evidence?
A. The data may not be in a readable format.
B. The database administrator could have manipulated the tool or data.
C. The query may not capture all relevant transactions.
D. The extraction process may impact system performance.
Correct Answer: B
Explanation: Evidence obtained through tools controlled by the auditee lacks independence;
the auditor should use their own extraction tools or validate results independently.
Question 4
,An IS auditor has completed fieldwork and identified a high-risk finding related to
unencrypted data transmission. The auditee disagrees with the finding. What should the
auditor do NEXT?
A. Remove the finding from the report since the auditee disagrees.
B. Escalate the disagreement directly to the audit committee.
C. Discuss the finding with the auditee to understand their perspective and provide
supporting evidence.
D. Lower the risk rating to avoid conflict.
Correct Answer: C
Explanation: Professional standards require auditors to discuss disagreements and provide
evidence supporting findings before escalating or modifying conclusions.
Question 5
An IS auditor is assessing the reliability of a system-generated exception report used as audit
evidence. The report is generated by a script written by the system administrator. Which
factor is MOST important in evaluating the evidence?
A. The length of the exception report.
B. Whether the script logic has been independently validated.
C. The format in which the report is presented.
D. The frequency with which the report is generated.
Correct Answer: B
, Explanation: System-generated evidence reliability depends on the integrity of the
generating process; independent validation of script logic confirms the report's
completeness and accuracy.
Question 6
When planning an IS audit engagement, the auditor should consider materiality. In the
context of an IS audit, materiality is BEST described as:
A. The total dollar value of the IT budget.
B. The significance of an omission or misstatement that could influence decisions.
C. The number of systems in scope for the audit.
D. The percentage of IT controls that are automated.
Correct Answer: B
Explanation: Materiality relates to the significance of findings in influencing decisions, not to
budget size or system count.
Question 7
An IS auditor is using statistical sampling to test the operating effectiveness of a control. The
auditor wants to conclude with 95% confidence that the deviation rate is less than 5%. The
sample results show a 3% deviation rate. What should the auditor conclude?
A. The control is operating effectively because the deviation rate is below 5%.
B. The auditor can conclude with 95% confidence that the deviation rate is less than 5%.
C. The sample size should be increased to reach a conclusion.
D. The control is not operating effectively because deviations were found.
