CISA Certified Information Systems Auditor 2 — Questions and Answers
Question 1: During an IS audit, an auditor discovers that a control is functioning as intended but the risk it mitigates has already been accepted by management. What is the BEST course of action?
- Report the control as effective and move on
- Document the accepted risk and note the control as redundant in the report (Correct answer)
- Recommend removing the control immediately
- Escalate to the board of directors
Correct answer: Document the accepted risk and note the control as redundant in the report
Auditors should document management-accepted risks and flag controls that may be redundant relative to the risk posture.
Question 2: Which of the following BEST describes the purpose of a control self-assessment (CSA)?
- To replace the external audit process
- To allow management and staff to assess controls collaboratively (Correct answer)
- To evaluate only financial controls
- To provide an independent third-party opinion
Correct answer: To allow management and staff to assess controls collaboratively
CSA is a technique where management and staff work together to assess the effectiveness of controls in their own areas.
Question 3: An organization uses a third-party cloud provider for critical data processing. Which audit approach is MOST appropriate to assess the provider's controls?
- Review the vendor's marketing materials
- Obtain and evaluate a SOC 2 Type II report (Correct answer)
- Conduct an on-site audit of every data center
- Rely solely on contractual guarantees
Correct answer: Obtain and evaluate a SOC 2 Type II report
A SOC 2 Type II report provides an independent assessment of a service organization's controls over a period of time.
Question 4: When evaluating IT governance, an IS auditor should PRIMARILY focus on whether:
- IT systems are using the latest technology
- IT strategy is aligned with business objectives (Correct answer)
- The IT department has sufficient headcount
- All software licenses are current
Correct answer: IT strategy is aligned with business objectives
IT governance ensures that IT investments and strategies are aligned with and support overall business objectives.
Question 5: A residual risk is BEST defined as:
- Risk that has been fully eliminated by controls
- Risk that remains after controls have been applied (Correct answer)
- Risk identified during the initial risk assessment
- Risk transferred to an insurance provider
Correct answer: Risk that remains after controls have been applied
Residual risk is the level of risk remaining after management has implemented controls and other risk responses.
Question 6: Which sampling technique is MOST appropriate when an auditor wants to give every transaction an equal chance of being selected?
- Judgmental sampling
- Stratified sampling
- Random sampling (Correct answer)
- Haphazard sampling
Correct answer: Random sampling
Random sampling ensures every item in the population has an equal probability of selection, reducing selection bias.
Question 7: During a post-implementation review of an ERP system, an auditor finds that user acceptance testing (UAT) was skipped. What is the PRIMARY risk?
- The project exceeded budget
- The system may not meet business requirements (Correct answer)
- Vendors may not be paid on time
- IT staff may lack training
Correct answer: The system may not meet business requirements
UAT validates that the system meets business requirements; skipping it increases the risk of deploying a system that does not satisfy user needs.
CISA Certified Information Systems Auditor 2
During an IS audit, an auditor discovers that a control is functioning as intended but the risk it mitigates has already been accepted by management.
What is the BEST course of action?