ISACA CISA Practice Test

CISA practice test: what's covered

• Certified Information Systems Auditor

Free CISA sample questions

1. An IS auditor is assigned to a new engagement reviewing the payroll system. Which should the IS auditor do FIRST?

   • A. Begin reviewing the access control lists for the payroll application
   • B. Obtain an understanding of the business process and identify related risks
   • C. Interview the payroll manager about recent changes
   • D. Pull a sample of payroll transactions for substantive testing
   Show answer

   Correct: B. Per ITAF, every IS audit begins with understanding the auditee's business and assessing risk — this drives scope, objectives, and the audit programme. Jumping into access reviews or sampling before risk assessment is an unfocused audit and a classic CISA trap. Interviewing the manager comes during planning, but only AFTER an understanding of the process is established from documentation.

2. Which of the following provides the GREATEST assurance about the independence of the internal IS audit function?

   • A. The audit charter is approved by executive management
   • B. The IS audit function reports administratively to the CFO
   • C. The IS audit function reports functionally to the audit committee of the board
   • D. Auditors rotate engagements every two years
   Show answer

   Correct: C. Reporting line to the audit committee (governance body) — not to management being audited — is the single strongest independence safeguard. Reporting to CFO compromises independence on finance-related audits. Charter approval and rotation help but don't equal a governance-level reporting line. This is a recurring CISA "independence" exam trap.

3. During fieldwork, an IS auditor discovers a material control weakness that was not in the original audit scope. What should the IS auditor do FIRST?

   • A. Ignore it — it is out of scope
   • B. Inform audit management and consider expanding the scope or issuing a separate observation
   • C. Immediately tell the process owner to fix it
   • D. Add it silently to the report at the end
   Show answer

   Correct: B. Out-of-scope material findings must be escalated to audit management for a decision on scope expansion or a separate report. Ignoring violates professional standards; informing the auditee first compromises independence; silently adding to the final report bypasses scope governance. ISACA emphasises communication up the chain.

4. An IS auditor is testing whether quarterly user access reviews are being performed. The BEST type of evidence is:

   • A. Verbal confirmation from the IT manager that reviews occur
   • B. Signed-off access review reports from the last four quarters with reviewer name, date, and exceptions logged
   • C. A flowchart of the access review process
   • D. The system administrator's screenshot of the user list
   Show answer

   Correct: B. Audit evidence hierarchy: documentary > observed > verbal. Signed-off recurring reports across the audit period give competent, sufficient, and reliable evidence. Verbal confirmation is the weakest. A flowchart shows design, not operation. A screenshot is point-in-time and proves nothing about quarterly cadence.

5. Which of the following BEST describes "control self-assessment" (CSA)?

   • A. A substantive test performed by the IS auditor
   • B. A facilitated process where business process owners assess the design and effectiveness of their own controls, with IS audit acting as facilitator
   • C. A penetration test conducted by an external firm
   • D. A quarterly compliance review by the legal team
   Show answer

   Correct: B. CSA empowers process owners (auditees) to evaluate their own controls; IS audit facilitates but does NOT own the assessment. The benefit is broader coverage and stronger ownership; the risk is reduced objectivity, so CSA supplements — not replaces — independent IS audit work. Confusing CSA with audit testing is a common trap.

Last updated: 2026-10-19

CISA practice test FAQ

Related practice tests

• ISACA CDPSE practice test
• ISACA CGEIT practice test
• ISACA CISM practice test
• ISACA CRISC practice test