ISACA CISA — Practice Questions flashcards

6 of 59 questions free to study here · 5 topics · the whole deck is built into Willys

Multiple-choice practice questions, one best answer each, on IS audit planning, evidence, sampling and reporting, IT governance and risk, development, operations, continuity and access security.

Get the app All ISACA CISA decks

Practice deck · part of ISACA CISA · written against: CISA exam content outline (2024 job practice). Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list

A newly appointed IS audit manager must prepare next year's audit plan for a company that has moved several key applications to cloud services. What should the IS audit manager do FIRST?

A) Select the systems that had the most findings last year
B) Schedule every application for audit on an equal rotation
C) Draft detailed test procedures for each cloud application
D) Understand the business and its IT environment

D) Understand the business and its IT environment

A risk-based plan starts with understanding the business and its IT environment and defining the audit universe; only then can each area's risk be assessed. Repeating last year's problem areas ignores how the risks have changed with the cloud move.
Auditing Process › Risk-Based Planning
Midway through fieldwork on a payroll system, the system owner refuses to give the IS auditor read-only access to the payroll database, citing confidentiality. What is the BEST course of action?

A) Remove the database from scope and complete all the remaining tests
B) Use reports the system owner prepares from the database instead
C) Obtain the data informally from a colleague who has access
D) Escalate to audit management; report any unresolved scope limitation

D) Escalate to audit management; report any unresolved scope limitation

Access problems go to audit management and the appropriate auditee management; if they stay unresolved, the report states the scope limitation and its effect on conclusions. Reports prepared by the auditee are weaker evidence and do not settle the access issue.
Auditing Process › Risk-Based Planning
An IS auditor reviewing IT governance finds that the board has delegated all IT decisions to the CIO and receives no reports on IT performance or risk. What is the GREATEST concern?

A) IT spending may be higher than that of comparable companies
B) The IT steering committee may hold too many meetings a year
C) The board is not exercising its accountability for IT governance
D) The CIO may have too little time left over for operational management

C) The board is not exercising its accountability for IT governance

The board remains ultimately accountable for governance of enterprise IT; executives run IT within its direction, and governance includes monitoring performance. Without reporting, the board cannot evaluate, direct or monitor IT.
IT Governance › Strategy and Frameworks
A project report shows earned value of 300,000, planned value of 400,000 and actual cost of 250,000. What should the IS auditor conclude?

A) The project is on schedule and under budget for the work done
B) The project is behind schedule and under budget for the work done
C) The project is ahead of schedule and over budget for the work done
D) The project is behind schedule and over budget for the work done

B) The project is behind schedule and under budget for the work done

SPI = EV ÷ PV = 300 ÷ 400 = 0.75, so it is behind schedule; CPI = EV ÷ AC = 300 ÷ 250 = 1.2, so the work done cost less than budgeted.
Acquisition and Development › Project Management
Finance closes the books using a set of complex spreadsheets that one analyst built and maintains alone. What should the IS auditor recommend?

A) Move them to a shared drive that all finance staff can edit
B) Manage them as critical end-user computing with change control
C) Ask the analyst to email the key formulas to the finance manager
D) Replace them immediately with a newly purchased ERP module

B) Manage them as critical end-user computing with change control

Critical spreadsheets should be inventoried, placed under version and change control, protected, backed up and reviewed by a second person. Letting all finance staff edit them would weaken control further.
Operations and Resilience › IT Operations
The marketing team asks the database administrator for read access to the customer database, and the administrator grants it. What should the IS auditor recommend?

A) Let the administrator decide access based on job titles
B) Require the IT security manager's approval for each request
C) Require the data owner's approval before access is granted
D) Require the marketing director's approval before granting

C) Require the data owner's approval before access is granted

The data owner, the business manager accountable for the data, decides who gets access; IT as custodian implements what the owner approves. The requester's own manager is not accountable for the customer data.
Protection of Assets › Frameworks and Classification

Unlock the whole deck

You are studying a free 6-question sample. All 59 questions of ISACA CISA — Practice Questions, the other 2 ISACA CISA decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More ISACA CISA decks

Audit Process and IT Governance Acquisition, Operations and Protection of Assets

← All ISACA CISA decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

ISACA CISA exam content outline (2024) — topic outline only; no text copied

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CISA® is a registered trademark of ISACA. This product is not affiliated with or endorsed by ISACA.

Use of these pages is covered by our Terms of Use.