Inspirational journeys

Follow the stories of academics and their research expeditions

CISA—Certified Information Systems Auditor - Part 192

Mary Smith

Thu, 16 Apr 2026

CISA—Certified Information Systems Auditor - Part 192

1. When preparing an audit report, the IS auditor should ensure that the results are supported by:

A) statements from IS management.
B) workpapers of other auditors.
C) an organizational control self-assessment.
D) sufficient and appropriate audit evidence.



2. The final decision to include a material finding in an audit report should be made by the:

A) audit committee.
B) auditee's manager.
C) IS auditor.
D) CEO of the organization



3. The success of control self-assessment (CSA) highly depends on:

A) having line managers assume a portion of the responsibility for control monitoring.
B) assigning staff managers the responsibility for building, but not monitoring, controls.
C) the implementation of a stringent control policy and rule-driven controls.
D) the implementation of supervision and the monitoring of controls of assigned duties.



4. Which of the following is an attribute of the control self-assessment (CSA) approach?

A) Broad stakeholder involvement
B) Auditors are the primary control analysts
C) Limited employee participation
D) Policy driven



5. Which of the following is the key benefit of control self-assessment (CSA)?

A) Management ownership of the internal controls supporting business objectives is reinforced.
B) Audit expenses are reduced when the assessment results are an input to external audit work.
C) Improved fraud detection since internal business staff are engaged in testing controls
D) Internal auditors can shift to a consultative approach by using the results of the assessment.



1. Right Answer: D
Explanation: ISACA's standard on 'reporting' requires the IS auditor have sufficient and appropriate audit evidence to support the reported results. Statements from IS management provide a basis for obtaining concurrence on matters that cannot be verified with empirical evidence. The report should be based on evidence collected during the course of the review even though the auditor may have access to the work papers of other auditors. The results of an organizational control self-assessment (CSA) could supplement the audit findings. Choices A, B and C might be referenced during an audit but, of themselves, would not be considered a sufficient basis for issuing a report.

2. Right Answer: C
Explanation: The IS auditor should make the final decision about what to include or exclude from the audit report. The other choices would limit the independence of the auditor.

3. Right Answer: A
Explanation: The primary objective of a CSA program is to leverage the internal audit function by shifting some of the control monitoring responsibilities to the functional area line managers. The success of a control self-assessment (CSA) program depends on the degree to which line managers assume responsibility for controls-Choices B, C and D are characteristics of a traditional audit approach, not a CSA approach.

4. Right Answer: A
Explanation: The control self-assessment (CSA) approach emphasizes management of and accountability for developing and monitoring the controls of an organization's business processes. The attributes of CSA include empowered employees, continuous improvement, extensive employee participation and training, at! of which are representations of broad stakeholder involvement. Choices B, C and D are attributes of a traditional audit approach.

5. Right Answer: A
Explanation: The objective of control self-assessment is to have business management become more aware of the importance of internal control and their responsibility in terms of corporate governance.Reducing audit expenses is not a key benefit of control self-assessment (CSA). improved fraud detection is important, but not as important as ownership, and is not a principal objective of CSA. CSA may give more insights to internal auditors, allowing them to take a more consultative role; however, this is an additional benefit, not the key benefit.

0 Comments

Leave a comment