What is the PRIMARY purpose of a documented audit program for an IS audit engagement?

To set out the procedures needed to achieve the engagement objectives

The head of IS audit reports to the audit committee only the percentage of planned audits completed each year. What is the MOST significant weakness of this reporting?

It shows output volume but not audit quality or coverage of key risks

An audit team finished an engagement under budget by dropping several planned test procedures, with no documented approval or rationale. What is the GREATEST concern?

The audit conclusions may lack sufficient and appropriate evidence

A data entry screen calculates a check digit for each customer account number that is keyed in. Which error is this control PRIMARILY designed to catch?

Transcription and transposition errors in the account number

While agreeing the engagement scope, the head of IT asks that the remote access gateway be excluded because it is low risk. The auditor has no evidence either way. What is the BEST response?

Assess the gateway's risk independently before deciding whether to exclude it

Which of the following BEST describes the objective of an integrated audit?

Assessing business process controls and related IT controls together

The audit plan includes a penetration test of the organization's internet-facing applications, to be performed by an outside firm. What should be in place BEFORE testing begins?

Written management authorization defining the scope, timing and rules of engagement

Halfway through an audit, the auditee asks to add a new system to the scope. How should this be handled?

Assess the request and, if accepted, formally approve the scope change with revised resources and timing

Free CISA Domain 1 Practice Questions with Answers

2026-10-19

These five CISA Domain 1 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 1, Information System Auditing Process, is 18% of the CISA exam.

Question 1: Audit Project Management

Internal audit uses an external firm to perform part of an IS audit under a co-sourcing arrangement. Who is responsible for the audit conclusions?

A. The external auditor of the financial statements, who may rely on the work
B. The head of internal audit, who supervises and reviews the firm's work
C. The audit committee that approved the arrangement
D. The external firm alone

Answer: B. Co-sourcing adds capacity, but the audit function remains responsible for the quality and conclusions of the work.

Exam mindset: Delegating work does not delegate responsibility.

Question 2: IS Audit Standards, Guidelines, and Codes of Ethics

An IS manager tells the auditor that backups are tested monthly, but there are no test records available. The auditor has a deadline approaching. What should the auditor do to meet professional standards?

A. Seek other corroborating evidence and, if none exists, report the control as unverified
B. Accept the manager's statement and record it in the working papers as the test evidence
C. Exclude backup testing from the report to meet the deadline and note it for next year
D. Ask the manager to create test records for the past year to support the statement

Answer: A. Standards require sufficient and appropriate evidence to support conclusions. When management's assertion cannot be corroborated, the auditor must report the lack of evidence rather than rely on unsupported statements.

Exam mindset: No evidence, no assurance.

Question 3: Audit Evidence Collection Techniques

An IS auditor plans to rely on a system-generated report of all user access changes to select a sample. What should the auditor do FIRST?

A. Select the sample directly from the report
B. Compare the report's total with last year's report and investigate large variances
C. Verify the report's completeness and accuracy, including its logic and parameters
D. Ask the system owner to sign the report

Answer: C. Information produced by the entity must be reliable before it is used as audit evidence or as a sampling population.

Exam mindset: Validate the population before sampling it.

Question 4: Types of Audits, Assessments, and Reviews

The organization plans to acquire a smaller firm and asks IS audit to support the due diligence process. Which focus area is MOST important for this IT review?

A. The efficiency of the target's IT help desk staff
B. Designing the future integrated IT architecture for both firms after the deal closes
C. The detailed configuration of each server and network device the target operates
D. Risks in the target's IT environment that could affect deal value or integration

Answer: D. IT due diligence identifies significant IT risks and liabilities, such as weak security, unsupported systems or licensing gaps, that affect the acquisition decision and integration. It informs management's deal decision.

Exam mindset: Due diligence surfaces risks that change the decision.

Question 5: Quality Assurance and Improvement of Audit Process

The audit function sends satisfaction surveys to auditees after each audit. What is the MAIN value of these surveys?

A. Insight into communication and process quality to improve how audits run
B. Evidence from the auditees that the reported findings were factually correct
C. Assurance that the audit function remains independent of the audited units
D. A basis for dropping findings that auditees rated as unhelpful or unfair

Answer: A. Feedback improves engagement practices, while quality of conclusions is assured by other means.

Exam mindset: Use feedback for process, not conclusions.

Keep practising

The quiz below draws more questions from every CISA Domain 1 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.