Audit-focused certification covering the IS audit process, governance and management of IT, systems acquisition and implementation, operations and resilience, and protection of information assets for the ISACA CISA exam, with a worked explanation on every practice question.
Free sample questions
No account needed. Every question has a worked explanation, just like the full bank.
lock_openFree sampleInformation Systems Auditing Processmedium
An IS auditor is preparing the annual audit plan for a mid-sized retail bank. Senior management has asked that prior-year findings drive the selection of auditable units, while the audit committee has asked for coverage that reflects the bank's current risk profile. Which approach should the IS auditor adopt as the PRIMARY basis for selecting auditable units?
- AAssess inherent risk, control risk and detection risk for each auditable unit and allocate effort to the highest residual risk areas.check_circle Correct
- BSchedule each auditable unit on a fixed three-year rotation so every system is covered at least once in the cycle.
- CRe-audit every area where the previous year's report contained a high-rated finding before considering any new auditable units.
- DPrioritise the auditable units that the available audit staff have the strongest technical familiarity with for the coming year.
Risk-based audit planning selects auditable units from inherent, control and detection risk rather than rotation, prior findings or auditor availability. ISACA IS Audit and Assurance Standards require the annual plan to reflect the organisation's current risk profile. The auditor combines inherent risk in each unit, the strength of related controls and the residual detection risk to rank units, so that scarce assurance effort lands where the chance and impact of material misstatement or control failure is greatest.
Why A is correct: This is the risk-based audit planning model required by ISACA standards; effort is concentrated where residual risk is highest, which is the defensible basis for an annual plan.
Why B is wrong: Fixed-rotation cycles are tempting because they look fair and predictable, but ISACA standards require selection driven by current inherent and control risk, not calendar rotation that ignores threat changes.
Why C is wrong: Following up prior findings is necessary but partial; it anchors the plan on history rather than the current risk profile and leaves emerging high-risk areas uncovered.
Why D is wrong: Staffing convenience is tempting in a resource-constrained team, but ISACA requires the plan to be driven by risk; auditor availability informs delivery, not selection.
lock_openFree sampleInformation Systems Auditing Processmedium
During scoping of an annual audit, the chief information officer offers the IS auditor a paid weekend role helping to redesign the access-provisioning workflow that the auditor is scheduled to review three months later. According to the ISACA Code of Professional Ethics, what should the IS auditor do FIRST?
- AAccept the engagement, document the dual role in the working papers and proceed with the planned audit under heightened supervision.
- BDecline the design work and disclose the offer to the audit committee or other appropriate governance body before continuing planning.check_circle Correct
- CAccept the design work but request that a peer auditor sign the eventual report so that independence in appearance is preserved.
- DDefer a decision until after the planned audit is complete, then accept the design role once the report has been issued.
The ISACA Code of Professional Ethics requires the IS auditor to avoid self-review threats and disclose any conflicts that could impair independence. Independence in fact and in appearance is foundational to ISACA's ethics framework. Designing a control the auditor will later evaluate is a classic self-review threat; the prescribed response is to refuse the conflicting work and notify the body charged with governance so they can decide how the audit should proceed.
Why A is wrong: Documentation alone does not cure the conflict; the auditor would be opining on a control they helped design, which impairs independence in appearance and in fact.
Why B is correct: The ISACA Code requires the auditor to maintain independence and objectivity; declining design work over a process they will audit, and disclosing the offer, is the correct first response.
Why C is wrong: Swapping the signer is tempting because it appears to insulate the report, but the firm or function still has a self-review threat and the engagement remains compromised.
Why D is wrong: Deferring looks neutral, yet accepting future paid work from an auditee during planning still creates a familiarity and self-interest threat that should be disclosed now.
lock_openFree sampleInformation Systems Auditing Processmedium
An IS auditor is scoping a review of a new cloud-based human resources system. The vendor cannot reconfigure the application to enforce maker-checker on bulk salary uploads in time for go-live, so the project sponsor proposes a quarterly reconciliation of upload files against approved change tickets. How should the IS auditor categorise the proposed reconciliation when documenting the control environment?
- AAs a preventive control that stops unauthorised salary changes from reaching the production payroll ledger.
- BAs a corrective control that automatically reverses any unauthorised salary uploads found in the production ledger.
- CAs a compensating control that substitutes for the missing maker-checker preventive control on bulk uploads.check_circle Correct
- DAs a directive control that instructs payroll staff how the bulk-upload approval workflow is supposed to operate.
When a primary preventive control is absent, an alternative control that mitigates the same risk should be documented as compensating, not preventive or detective alone. Control-type classification follows the control's function relative to the risk and the missing primary control. Because maker-checker (preventive) cannot be enforced, the quarterly reconciliation substitutes for it. ISACA guidance characterises such substitutes as compensating controls, distinct from purely detective controls that exist alongside a working preventive one.
Why A is wrong: Preventive controls act before the event; a reconciliation performed quarterly reviews entries after they have posted, so calling it preventive misclassifies its timing.
Why B is wrong: Corrective controls restore a correct state after detection; a reconciliation surfaces variances but does not, by itself, reverse the transactions it identifies.
Why C is correct: Compensating controls are introduced when a primary control cannot be implemented; the reconciliation provides a substitute assurance over the same risk and should be documented as such.
Why D is wrong: Directive controls are policies and procedures that set expectation; a reconciliation activity is an operating control, not a statement of how staff should behave.
Frequently asked questions
- How many questions are on the CISA exam?
- The Certified Information Systems Auditor (CISA) (CISA) exam has 150 questions and runs for 240 minutes. The format is multiple choice, computer-based at psi testing centres or remote proctored.
- What score do I need to pass CISA?
- The pass mark is 450 / 800. Examworthy gives you a per-domain readiness score so you can see which domains are holding you back before you book.
- How much does the CISA exam cost?
- The exam costs 575 USD to sit. Practising on Examworthy is free to start, with a worked explanation on every question.
- How does Examworthy help me prepare for CISA?
- Every practice question carries a worked explanation and a per-distractor rationale, mapped to the official blueprint domains. You learn why each answer is right or wrong, not just the letter.
- Is Examworthy affiliated with ISACA?
- No. Examworthy is not affiliated with or endorsed by ISACA. Our questions are original, blueprint-aligned practice material; we never reproduce live exam items.
Examworthy is not affiliated with or endorsed by ISACA. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. CISA and related marks belong to their respective owners.
