CISA exam questions

1. Question 1

   Single answer

   An IT balanced scorecard is the MOST effective means of monitoring:

   • A

     governance of enterprise IT.

   • B

     control effectiveness.

   • C

     return on investment (ROI).

   • D

     change management effectiveness.

   Reveal answer

   Correct answer

   • A

     governance of enterprise IT.

   Explanation

   An IT balanced scorecard is a strategic management tool that aligns IT objectives with business goals and measures the performance of IT processes using key performance indicators (KPIs). It is the most effective means of monitoring governance of enterprise IT, which is the process of ensuring that IT supports the organization’s strategy and objectives. Governance of enterprise IT covers aspects such as IT value delivery, IT risk management, IT resource management, and IT performance measurement. An IT balanced scorecard can help monitor these aspects and provide feedback to improve IT governance. ISACA Frameworks: Blueprints for Success, CISA Review Manual (Digital Version)

2. Question 2

   Single answer

   An organizations audit charier PRIMARILY:

   • A

     describes the auditors' authority to conduct audits.

   • B

     defines the auditors' code of conduct.

   • C

     formally records the annual and quarterly audit plans.

   • D

     documents the audit process and reporting standards.

   Reveal answer

   Correct answer

   • A

     describes the auditors' authority to conduct audits.

   Explanation

   An organization’s audit charter primarily describes the auditors’ authority to conduct audits. The audit charter is a formal document that defines the purpose, scope, responsibilities, and reporting relationships of the internal audit function. It also establishes the auditors’ right of access to information, records, personnel, and physical properties relevant to their work. The audit charter provides the basis for the auditors’ independence and accountability to the governing body and senior management.

3. Question 3

   Single answer

   The decision to accept an IT control risk related to data quality should be the responsibility of the:

   • A

     information security team.

   • B

     IS audit manager.

   • C

     chief information officer (CIO).

   • D

     business owner.

   Reveal answer

   Correct answer

   • D

     business owner.

   Explanation

   The decision to accept an IT control risk related to data quality should be the responsibility of the business owner. The business owner is the person who has the authority and accountability for the business process that relies on the data quality. The business owner should understand the impact of data quality issues on the business objectives, performance, and compliance. The business owner should also be involved in defining the data quality requirements, assessing the data quality risks, and implementing the data quality controls or mitigation strategies.

4. Getting the hang of it? 1,594 more CISA questions are waiting, each with its answer. Unlock them all

5. Question 4

   Single answer

   Which of the following data would be used when performing a business impact analysis (BIA)?

   • A

     Projected impact of current business on future business

   • B

     Cost-benefit analysis of running the current business

   • C

     Cost of regulatory compliance

   • D

     Expected costs for recovering the business

   Reveal answer

   Correct answer

   • D

     Expected costs for recovering the business

   Explanation

   The expected costs for recovering the business would be used when performing a business impact analysis (BIA). A BIA is a process of identifying and evaluating the potential effects ofdisruptions to critical business functions or processes. A BIA helps to determine the recovery priorities, strategies, and resources needed to resume normal operations after a disruption. One of the key outputs of a BIA is an estimate of the financial losses or costs associated with different types of disruptions, such as lost revenue, increased expenses, contractual penalties, or regulatory fines.

6. Question 5

   Single answer

   During the evaluation of controls over a major application development project, the MOST effective use of an IS auditor's time would be to review and evaluate:

   • A

     application test cases.

   • B

     acceptance testing.

   • C

     cost-benefit analysis.

   • D

     project plans.

   Reveal answer

   Correct answer

   • A

     application test cases.

   Explanation

   Reviewing and evaluating application test cases is the most effective use of an IS auditor’s time during the evaluation of controls over a major application development project. Application test cases are designed to verify that the application meets the functional and non-functional requirements and specifications. They also help to identify and correct any errors, defects, or vulnerabilities in the application before it is deployed. By reviewing and evaluating the test cases, the IS auditor can assess the quality, reliability, security, and performance of the application and provide recommendations for improvement.

7. Question 6 Locked Unlock to see this question
8. Question 7 Locked Unlock to see this question

Back to the CISA exam page