Free CISA practice test

Answer: D. A risk-based approach puts audit effort where the risk of material error or failure is highest. Ease of testing, last year's program or one manager's preference can leave high-risk areas undertested.

Answer: D. The question is whether a control operated, which is a yes/no attribute, so attribute sampling estimates the deviation rate. Variable sampling estimates monetary amounts, and picking only the largest invoices gives no basis to project a rate to the population.

Answer: D. The control failed during the audit period, so the finding still belongs in the report. Recording the corrective action gives readers a fair picture; dropping the finding hides a real exposure, and leaving out the fix makes the report less accurate, not more independent.

Answer: B. Auditing your own design work threatens independence and objectivity, so it must be disclosed and the audit lead should decide whether to reassign. Management sign-off does not remove the impairment, and splitting the scope still leaves the auditor reviewing a process they shaped.

Answer: B. An IT steering committee brings business and IT management together to prioritise and oversee IT investments against business goals. Internal and external auditors must stay independent of such decisions, and an operations team has no authority over the portfolio.

Answer: C. The company stays accountable for payroll data, so it needs reliable evidence about the provider's controls; an independent assurance report gives that now and audit rights can be negotiated later. Bringing the service in-house is disproportionate, and a sales email is not reliable evidence.

Answer: D. When duties cannot be separated, an independent review of what the person actually did can detect unauthorised changes. A code of conduct and password changes do nothing to detect misuse, and hardware has no bearing on the control gap.

Answer: D. Risk acceptance is only valid when an authorised owner accepts it within the risk appetite, so the auditor must check that authority and documentation. Editing the register would compromise independence, and jumping to a technical fix skips the governance issue.

Answer: C. Controls designed in from the start are far cheaper and more effective than controls added after go-live, so reviewing requirements and design is the auditor's best contribution. Approving budgets, coding or doing acceptance testing would make the auditor part of management and impair independence.

Answer: B. Reconciling counts and financial control totals proves that every record arrived and values were not altered. Waiting for users to complain detects errors too late, screen speed says nothing about data, and retained hardware helps fallback but does not show the conversion was right.

Answer: B. The recovery point objective sets how much data loss is tolerable, so data must be captured at least every four hours. Nightly, weekly or monthly backups could lose up to a day or more of orders.

Answer: C. Good change management allows emergency changes but requires them to be logged and approved retrospectively so unauthorised changes can be spotted. Ignoring them leaves a control gap, removing a working fix harms the business, and punishing the developer misses the process issue.

Answer: A. In a parallel test the recovery systems run alongside production without shutting production down. Checklist and tabletop tests do not bring systems up at all, and a full interruption test deliberately stops the primary site.

Answer: D. Incident management restores service; problem management investigates recurring incidents to find and fix the underlying cause. The incidents are already logged, and neither service desk staffing nor release management addresses the root cause.

Answer: C. A plan written for systems that no longer exist cannot be trusted, so the BIA and plan must be updated before a meaningful test. Testing an outdated plan first wastes effort and a disruptive full test is risky; a second site does not fix an obsolete plan.

Answer: B. Linking the HR leaver process to account removal closes access at the point someone leaves. Reminders are weak and slow, password rules do not stop a valid ex-employee from logging in, and a two-year inactivity rule leaves accounts open far too long.

Answer: A. Shared accounts destroy individual accountability, because logs cannot show which person made a change. Individual named accounts, ideally managed through privileged access controls, fix this; password length and convenience are secondary issues.

Answer: B. The data owner understands the business value and sensitivity of the data and is accountable for its classification. Administrators act as custodians who apply the protection, and an auditor must not make management decisions.

Answer: D. Re-performing the control on a sample shows whether inappropriate access really is being found and removed. A policy or an interview only shows how the review should work, and calendar entries prove a meeting happened, not that access was correct.

Answer: C. Full disk encryption keeps the data unreadable even when the thief has the device. A cable lock does not help in a car, a screen saver is bypassed by removing the disk, and an asset tag does nothing to protect data.