Certified Information Systems Auditor (CISA)

Multiple Choice Questions:

1. Is the following statement true or false?
Database snapshots can provide an excellent audit trail for an IS auditor.
a. True
b. False

2. An IS auditor reviews an application's access to determine whether the

ten most recent "new user" forms were correctly authorised. This is an
example of ______________________.
a. Variable sampling
b. Substantive testing
c. Compliance testing
d. Stop-or-go sampling

3. Which of the following sampling methods is most useful when testing for
compliance?
a. Attribute sampling
b. Variable sampling
c. Stratified mean per unit
d. Difference estimation

4. Which of the following is the most likely reason e-mail systems have
become a valuable source of evidence for litigation?
a. Multiple cycles of backup files remain available.
b. Access controls establish accountability for e-mail activities.
c. Data classification regulates what information should be
communicated via e-mail.
d. Within the enterprise, a clear policy for using e-mail ensures that
evidence is available.
5. The primary advantage of a continuous audit approach is that it
_______________________.
a. Does not require an IS auditor to collect evidence on system
reliability while processing is taking place.
b. Requires the IS auditor to review and follow up immediately on all
information collected.
c. Can improve system security when used in time-sharing
environments that process a large number of transactions.
d. Does not depend on the complexity of an organisation's computer
system.

6. To ensure that audit resources deliver the best value to the organisation,
the first step would be to _____________________
a. Schedule the audits and monitor the time spent on each audit.
b. Train the IS audit staff on current technology used in the
company.
c. Develop the audit plan based on a detailed risk assessment.
d. Monitor the progress of audits and initiate cost control measures.

7. While planning an audit, an assessment of risk should be made to

provide ___________________.
a. Reasonable assurance that the audit will cover the material item.
b. Definite assurance that material items will be covered during the
audit work.
c. Reasonable assurance that all items will be covered by the audit.
Sufficient assurance that all items will be covered during the audit
work.

8. When selecting audit procedures, an IS auditor should use professional

judgment to ensure that _____________________.
a. Sufficient evidence will be collected.
b. All significant deficiencies identified will be corrected within a
reasonable period.
c. All material weaknesses will be identified.
d. Audit costs will be kept at a minimum level.
9. An IS auditor is performing an audit of a remotely managed server
backup. The IS auditor reviews the logs for one day and finds one case
where logging on a server has failed, with the result that backup restarts
cannot be confirmed. What should the auditor do?
a. Issue an audit finding.
b. Seek an explanation from IS management.
c. Review the classifications of data held on the server.
d. Expand the sample of logs reviewed.

10. Which of the following is the primary advantage of using computer

forensic software for investigations?
a. The preservation of the chain of custody for electronic evidence.
b. Time and cost savings.
c. Efficiency and effectiveness.
d. Ability to search for violations of intellectual property rights.

11. The vice president of human resources has requested an audit to

identify payroll overpayments for the previous year. Which would be the
best audit technique to use in this situation?
a. Test data
b. Generalised audit software
c. Integrated test facility
d. Embedded audit module

12. Which of the following would normally be the most reliable evidence
for an auditor?
a. A confirmation letter received from a third party verifying an
account balance.
b. Assurance from line management that an application is working as
designed.
c. Trend data obtained from World Wide Web (Internet) sources.
d. Ratio analysts developed by the IS auditor from reports supplied
by line management.
13. Which of the following would be the best population to take a sample
from when testing program changes?
a. Test library listings
b. Source program listings
c. Program change requests
d. Production library listings

14. An integrated test facility is considered a useful audit tool because it

_______________.
a. Is a cost-efficient approach to auditing application control.
b. Enables the financial and IS auditors to integrate their audit test.
c. Compares processing output with independently calculated data.
d. Provides the IS auditor with a tool to analyse a large range of
information.

15. Data flow diagrams are used by IS auditors to _________________.

a. Order data hierarchically.
b. Highlight high-level data definition.
c. Graphically summarise data paths and storage.
d. Portray step-by-step details of data generation.

16. The best method of proving the accuracy of a system tax calculation is
by _______________.
a. Detailed visual review and analysis of the source code of the
calculation programs.
b. Recreating program logic using generalised audit software to
calculate monthly total.
c. Preparing simulated transactions for processing and comparing
the results to predetermined result.
d. Automatic flowcharting and analysis of the source code of the
calculation program.
17. In an audit of an inventory application, which approach would provide
the best evidence that purchase orders are valid?
a. Testing whether inappropriate personnel can change application
parameters.
b. Tracing purchase orders to a computer listing.
c. Comparing receiving reports to purchase order details.
d. Reviewing the application documentation.

18. Which of the following online auditing techniques is most effective for
the early detection of errors or irregularities?
a. Embedded audit module
b. Integrated test facility
c. Snapshots
d. Audit hooks

19. While conducting an audit, an IS auditor detects the presence of a virus.

What should be the IS auditor's next step?
a. Observe the response mechanism.
b. Clear the virus from the network.
c. Inform appropriate personnel immediately.
d. Ensure deletion of the virus.

20. Which of the following audit techniques would BEST aid an auditor in
determining whether there have been unauthorised program changes
since the last authorised program update?
a. Test data run
b. Code review
c. Automated code comparison
d. Review of code migration procedures
21. During a change control audit of a production system, an IS auditor finds
that the change management process is not formally documented and
that some migration procedures failed. What should the IS auditor do
next?
a. Recommend redesigning the change management process.
b. Gain more assurance on the findings through root cause analysis.
c. Recommend that program migration be stopped until the change
process is documented.
d. Document the finding and present it to management.

22. An IS auditor conducting a review of software usage and licensing

discovers that numerous PCs contain unauthorised software. Which of
the following actions should the IS auditor take?
a. Personally, delete all copies of the unauthorised software.
b. Inform the auditee of the unauthorised software, and follow up to
confirm deletion.
c. Report the use of the unauthorised software and the need to
prevent recurrence to auditee management.
d. Take no action, as it is a commonly accepted practice and
operations management is responsible for monitoring such us.

23. The final decision to include a material finding in an audit report should
be made by the __________________.
a. Audit committee
b. Auditee's manage
c. IS auditor
d. CEO of the organisation

24. Effective IT governance will ensure that the IT plan is consistent with the
organisation's____________________.
a. Business plan
b. Audit plan
c. Security plan
d. Investment plan
25. IT governance is primarily the responsibility of the ________________.
a. Chief executive office
b. Board of director
c. IT steering committee
d. Audit committee

26. Which of the following IT governance best practices improves strategic

alignment?
a. Supplier and partner risks are managed.
b. A knowledge base on customers, products, markets and processes
is in place.
c. A structure is provided that facilitates the creation and sharing of
business information.
d. Top management mediate between the imperatives of business
and technology.

27. Effective IT governance requires organisational structures and processes

to ensure that _________________.
a. The organisation's strategies and objectives extend the IT
strategy.
b. The business strategy is derived from an IT strategy.
c. IT governance is separate and distinct from the overall
governance.
d. The IT strategy extends the organisation's strategies and
objective.

28. Responsibility for the governance of IT should rest with the:

a. IT strategy committee
b. Chief information officer (CIO).
c. Audit committee
d. Board of director
29. Many organisations require an employee to take a mandatory vacation
(holiday) of a week or more to:
a. Ensure the employee maintains a good quality of life, which will
lead to greater productivity.
b. Reduce the opportunity for an employee to commit an improper
or illegal act.
c. Provide proper cross-training for another employee.
d. Eliminate the potential disruption caused when an employee
takes vacation one day at a time.

30. A local area network (LAN) administrator normally would be restricted

from __________________.
a. Having end-user responsibilities.
b. Reporting to the end-user manage.
c. Having programming responsibilities.
d. Being responsible for LAN security administration.

31. A long-term IS employee with a strong technical background and broad

managerial experience has applied for a vacant position in the IS audit
department. Determining whether to hire this individual for this position
should be based on the individual's experience and ______________.
a. Length of service, since this will help ensure technical
competency.
b. Age, as training in audit techniques may be impractical.
c. IS knowledge, since this will bring enhanced credibility to the audit
function.
d. Ability, as an IS auditor, to be independent of existing IS
relationship.
32. Which of the following reduces the potential impact of social
engineering attacks?
a. Compliance with regulatory requirements
b. Promoting ethical understanding
c. Security awareness programs
d. Effective performance incentives

33. To gain an understanding of the effectiveness of an organisation's

planning and management of investments in IT assets, an IS auditor
should review the ___________________.
a. Enterprise data mode
b. IT balanced scorecard (BSC)
c. IT organisational structure
d. Historical financial statement

34. Which of the following would an IS auditor consider the MOST relevant
to short-term planning for an IS department?
a. Allocating resources.
b. Keeping current with technology advances.
c. Conducting control self-assessment.
d. Evaluating hardware needs.

35.Which of the following would an IS auditor consider to be the most

important when evaluating an organisation's IS strategy? That it
________________.
a. Has been approved by line management.
b. Does not vary from the IS department's preliminary budge.
c. Complies with procurement procedure.
d. Supports the business objectives of the organisation.
36. When reviewing IS strategies, an IS auditor can best assess whether IS
strategy supports the organisations' business objectives by determining
if IS _______________.
a. Has all the personnel and equipment it needs.
b. Plans are consistent with management strategy.
c. uses its equipment and personnel efficiently and effectively.
d. has sufficient excess capacity to respond to changing direction.

37. When reviewing the IT strategic planning process, an IS auditor should

ensure that the plan __________________.
a. Incorporates state of the art technology.
b. Addresses the required operational control.
c. Articulates the IT mission and vision.
d. Specifies project management practice.

38. When developing a formal enterprise security program, the most critical
success factor (CSF) would be the_________________.
a. Establishment of a review boar
b. Creation of a security unit.
c. Effective support of an executive sponsor.
d. Selection of a security process owned.

39. When reviewing an organisation's strategic IT plan an IS auditor should

expect to find_________________.
a. An assessment of the fit of the organisation's application portfolio
with business objective.
b. Actions to reduce hardware procurement cost.
c. A listing of approved suppliers of IT contract resource.
d. A description of the technical architecture for the organisation's
network perimeter security.
40. The advantage of a bottom-up approach to the development of
organisational policies is that the policies____________________.
a. Are developed for the organisation as a whole.
b. Are more likely to be derived as a result of a risk assessment.
c. Will not conflict with overall corporate policy.
d. Ensure consistency across the organisation.