Free CISA Practice Test Questions and Answers (2026)

The absence of periodic external assessments is a direct violation of mandatory professional standards, such as The Institute of Internal Auditors (IIA) Standard 1312, which requires an external quality assessment at least once every five years. This is a fundamental component of a Quality Assurance and Improvement Program (QAIP). Failure to perform this independent review presents the greatest concern because it undermines the credibility, objectivity, and perceived value of the entire internal audit function. It deprives the audit committee and senior management of independent assurance that the audit activity conforms with globally recognized standards and operates effectively.

B. While reporting to the audit committee is critical, the specific frequency (e.g., quarterly) is a procedural detail; a lack of reporting altogether would be the core issue.

C. Inconsistent tracking of corrective actions is a significant internal process weakness, but the lack of an external assessment is a more fundamental governance failure that would likely identify such issues.

D. The use of substantive testing depends on the specific audit's objectives and risk assessment; its absence is not inherently a quality assurance failure for all audits.

---

1. The Institute of Internal Auditors (IIA)

International Standards for the Professional Practice of Internal Auditing (Standards)

July 2023. Standard 1312: External Assessments states

"External assessments must be conducted at least once every five years by a qualified

independent assessor or assessment team from outside the organization." The standard's interpretation notes that this assessment provides an independent opinion on the internal audit activity's conformance with the Standards and Code of Ethics.

2. ISACA

CISA Review Manual

27th Edition

2019. Domain 1: Information System Auditing Process

Section 1.5.4 Quality Assurance of the Audit Function. This section discusses the need for a quality assurance and improvement program that includes both internal and external reviews to ensure the audit function's compliance with standards and its overall effectiveness. The manual emphasizes that external reviews provide independent assurance to stakeholders.

3. Anderson

U. L.

Head

M. J.

Ramamoorti

S.

Riddle

C.

Salamasick

M.

& Sobel

P. J. Internal Auditing: Assurance & Advisory Services

4th Edition. The IIA Research Foundation

2017. Chapter 2

"The International Professional Practices Framework: Authoritative Guidance for the Internal Audit Profession

" details the components of a QAIP

explicitly citing Standard 1312 and explaining that external assessments are crucial for validating the internal audit function's conformance with professional standards and identifying opportunities for improvement.

The IS auditor's immediate responsibility is to report findings and significant developments within the audit's chain of command. The decision by new management to not implement previously accepted recommendations represents a change in risk acceptance and is a material finding for the follow-up audit. The auditor must report this to the audit manager, who is responsible for overseeing the audit engagement. The audit manager will then determine the appropriate next steps, which may include discussing the issue with senior management and deciding whether escalation to the audit committee is warranted. This ensures that the audit function's internal procedures and reporting lines are respected.

A. Notifying the chair of the audit committee is a significant escalation. This step should be determined by audit management, not undertaken unilaterally by the auditor as a first action.

C. Retesting the control is irrelevant. The issue is not the control's operational effectiveness but management's conscious decision not to implement the agreed-upon remediation.

D. Closing the audit finding is incorrect. The finding cannot be closed because the risk has not been mitigated as planned. Management's decision to accept the risk must be documented and reported.

---

1. ISACA

CISA Review Manual

27th Edition. Chapter 1

The Process of Auditing Information Systems

p. 59. The manual states

"The IS auditor should report to the audit manager/director... The audit manager/director is responsible for ensuring that the communication is directed to the appropriate parties." This establishes the correct internal reporting line that the auditor must follow.

2. ISACA

ITAF: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Guideline 2401 Reporting

Section 2401.7 Supervisory Review. This guideline emphasizes that "IS audit and assurance work papers should be reviewed by a senior member of the IS audit and assurance function before the audit reports are finalized and issued." This reinforces the principle that findings

especially significant ones like a change in management's risk posture

must be reviewed internally by management (i.e.

the audit manager) first.

3. ISACA

CISA Review Manual

27th Edition. Chapter 1

The Process of Auditing Information Systems

p. 61. Regarding follow-up

it notes

"If management has assumed the risk of not correcting the reported condition

this should be documented by the IS auditor and communicated to senior management and the audit committee." While this communication is necessary

the process begins with reporting the situation to the audit manager

who then directs these subsequent communications.

The principle of least privilege is a fundamental security concept requiring that users be granted only the access and permissions necessary to perform their job duties. In this scenario, providing administrator rights to most users on an externally facing system containing sensitive data is a severe violation of this principle. Administrator privileges inherently grant the ability to alter system configurations, modify or delete data, and change security settings. This creates the greatest risk of unauthorized changes, whether malicious or accidental, which directly compromises the integrity, availability, and confidentiality of the system and its data.

A. While administrators can export logs, this is a specific action. The ability to make any unauthorized change is a much broader and more significant risk.

B. Viewing sensitive data is a function of the system for both user types. The core issue highlighted is the risk from excessive privileges, not authorized access.

D. Installing software is a subset of the actions an administrator can perform. The overarching risk is the general capability to make unauthorized changes, which includes more than just software installation.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations

Maintenance and Service Management

Section 4.4 Logical Access. The manual emphasizes that access rights should be granted based on the "need-to-know" and "need-to-do" principles

and that powerful privileges (such as administrator rights) must be strictly controlled to prevent unauthorized activities that could compromise the system.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5. Security and Privacy Controls for Information Systems and Organizations

Control AC-6 "Least Privilege." This control states: "The organization employs the principle of least privilege

allowing only authorized accesses for users...that are necessary to accomplish assigned tasks." The discussion section notes that this prevents users from making unauthorized changes or performing functions outside their roles.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278-1308. This foundational academic paper introduces the principle of least privilege

stating

"Every program and every user of the system should operate using the least set of privileges necessary to complete the job." The rationale is to limit the damage that can result from an accident or error. (DOI: https://doi.org/10.1109/PROC.1975.9939

Section I.A.3).

The integrity of the audit trail is paramount for an IS auditor. If a firewall is compromised, an attacker's first action is often to alter or delete local logs to cover their tracks. Storing logs on a separate, protected host (e.g., a SIEM or a hardened log server) ensures that a reliable and tamper-evident record of all network activity and potential security incidents is preserved. This preserved evidence is essential for forensic investigation, incident response, and for the auditor to verify the firewall's operational effectiveness over time.

B. Automated alerts are being sent when a risk is detected: Alerts are generated from log data. If the underlying logs are not protected and can be tampered with (as addressed in A), the alerts become unreliable or may not be generated at all.

C. Insider attacks are being controlled: This is a broad security objective, not a specific firewall control. A firewall is only one component in a defense-in-depth strategy to mitigate insider threats.

D. Access to configuration files Is restricted: While this is a critical preventive control, a system can still be compromised via other means (e.g., a zero-day vulnerability). In such a case, secure, external logs are the only way to detect and investigate the breach. The integrity of evidence (logs) is fundamental to the audit function.

---

1. ISACA

CISA Review Manual

27th Edition

2019.

Page 213

Section 4.4.4 Security Event Logging and Monitoring: "The IS auditor should verify that security events are logged and that the logs are secured to prevent tampering... Log data should be sent to a dedicated log server to prevent the logs from being destroyed by an attacker." This directly supports the critical need to secure logs on a separate host to prevent tampering

which is a primary concern for an auditor.

2. ISACA

"Auditing Network Perimeters

" Audit Program

2016.

Section 3.2.4: The audit program directs the auditor to "Verify that firewall logs are enabled to log all inbound and outbound traffic

and sent to a dedicated and secured log server." This step is crucial for ensuring a complete and reliable audit trail

which underpins the entire audit of the control's operation.

3. NIST Special Publication 800-92

"Guide to Computer Security Log Management

" 2006.

Section 3.4.1

Page 3-10: "Organizations should store logs on dedicated log servers

not on the hosts that generate the logs... Storing logs on a different system from the one that generates them makes it more difficult for attackers to tamper with the logs." This official guideline establishes the practice as a fundamental security principle for maintaining log integrity.

The primary objective of an IT strategy is to ensure that IT plans and activities support and enable the overall business strategy. An IT strategy derived solely from market trends is fundamentally misaligned with the organization's specific goals and needs. This represents the greatest strategic risk because it can lead to the misallocation of resources, investment in inappropriate technologies, and a failure to deliver value to the business. The IS auditor's main concern in a strategic review is this alignment between business objectives and IT initiatives.

A. Defining target architecture at a technical level within a strategy document can indicate thorough planning and is not inherently a concern.

B. While not achieving prior goals is a concern about execution, a flawed basis for the current strategy is a more fundamental and critical issue.

D. Including financial estimates is a best practice for effective planning, budgeting, and demonstrating due diligence, not a point of concern.

1. ISACA. (2019). CISA Review Manual

27th Edition. Domain 2: Governance and Management of IT

Section 2.3.1 IT Strategic Plan. The manual states

"The IT strategic plan must be an integral part of the overall business strategic plan... The focus should be on strategic alignment..." This highlights that the business plan

not external trends alone

must be the primary driver.

2. ISACA. (2018). COBIT 2019 Framework: Introduction and Methodology. Chapter 3

The COBIT Core Model

p. 21. The COBIT goals cascade model explicitly shows that enterprise goals are derived from stakeholder needs

and alignment goals (IT-related goals) are derived from enterprise goals. This framework establishes a clear top-down linkage from business needs to IT strategy.

3. Luftman

J. N. (2000). Assessing business-IT alignment maturity. Communications of the Association for Information Systems

4(1)

Article 14. This foundational academic paper on strategic alignment maturity notes that lower levels of maturity are characterized by a lack of a clear

business-driven IT strategy. Relying on trends instead of business goals is indicative of low alignment maturity. (DOI: https://doi.org/10.17705/1CAIS.00414)

The primary consideration for an IS auditor when determining which issues to include in an audit report is materiality. Materiality refers to the significance of a finding in the context of the audit objectives. An audit finding is material if its omission or misstatement could influence the decisions of management or other stakeholders. The purpose of the audit report is to communicate significant findings that require management's attention and potential action. Focusing on material issues ensures that the report is relevant, impactful, and drives improvements in governance, risk management, and control, rather than overwhelming stakeholders with trivial details.

A. Professional skepticism is a critical professional attitude and mindset that must be applied throughout the entire audit process, not a specific criterion for selecting which findings to report.

B. Requiring management's agreement on findings before inclusion would fundamentally compromise the auditor's independence and objectivity, which are cornerstones of the audit profession.

D. Inherent risk is assessed during the audit planning phase to determine the nature and extent of audit procedures, not to decide which identified findings are significant enough for the final report.

---

1. ISACA. (2019). CISA Review Manual

27th Edition. Section 1.3.2

"Materiality

" states

"Materiality is a key concept that will be used when planning the audit and when evaluating the identified errors and irregularities... The IS auditor should consider materiality when determining the reportable findings."

2. ISACA. (2014). ITAF: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Guideline 2204

"Materiality

" Section 3.1

notes that "IS audit and assurance professionals should consider materiality and its relationship to audit risk when... evaluating the effect of identified control weaknesses and/or lack of compliance with established processes." This evaluation directly informs what is reported.

3. Singleton

T. (2011). The Core of the CISA Exam. ISACA Journal

Volume 2. This article emphasizes that a CISA candidate must understand core concepts

stating

"Materiality is a concept that relates to the importance or significance of an amount

transaction or discrepancy... The IS auditor must consider materiality in determining the appropriate reportable conditions."

The presence of unused applications indicates a failure in managing the entire lifespan of IT assets. Asset life cycle management is a comprehensive process that governs an asset from planning and acquisition through deployment, utilization, maintenance, and eventual retirement. Implementing this framework ensures that applications are periodically reviewed for their continued business value and are properly decommissioned when no longer needed. This proactive management directly prevents the accumulation of unused software ("shelfware") by embedding review and retirement phases into standard procedure, addressing the root cause of the problem.

A. A formal request for proposal (RFP) process only addresses the procurement phase, not the ongoing management or retirement of the asset.

B. Business case development justifies the initial acquisition but does not ensure the asset is used or retired appropriately later in its life cycle.

C. An information asset acquisition policy governs how assets are purchased but does not cover their management throughout their useful life and disposal.

---

1. ISACA

CISA Review Manual

27th Edition (2019). Domain 2: IT Governance and Management

Section 2.5

"IT Resource Management." This section details the importance of managing IT assets throughout their life cycle

including acquisition

deployment

maintenance

and retirement

to ensure they continue to provide value to the business.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). Management Objective BAI09

Managed Assets. This objective explicitly covers the need to "Manage IT assets through their life cycle to make sure that their use is optimized for value

and they are disposed of in a timely and proper manner." (p. 153).

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). Management Objective APO05

Managed Portfolio. This objective includes practices for managing the portfolio of IT-enabled investments

which involves evaluating and retiring obsolete or low-value applications and services to optimize overall portfolio value. (p. 85).

Information classification is a fundamental process in information security governance and risk management. Its primary purpose is to ensure that security controls are applied in a manner that is proportionate to the value of the information and the potential impact of its compromise. This potential impact—covering confidentiality, integrity, and availability—is the definition of business risk. Therefore, aligning the classification scheme directly with business risk ensures that the most critical assets receive the highest level of protection, optimizing security investments and effectively mitigating threats to the organization's objectives.

B. The security policy mandates and defines the classification process, but the classification levels within the policy must be based on business risk.

C. Data retention requirements are an important part of the information lifecycle but are a consequence of classification and legal/regulatory needs, not the primary driver for it.

D. Industry standards provide valuable frameworks and best practices, but they must be adapted to the specific business context and risk appetite of the organization.

1. ISACA

CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.4.2

"Information Asset Classification." The manual states

"The objective of classification is to ensure that information assets receive an appropriate level of protection... The classification is based on the value of the asset to the organization

its sensitivity and its criticality." This concept of value

sensitivity

and criticality is a direct measure of business risk.

2. ISACA

COBIT® 2019 Framework: Governance and Management Objectives. Management Objective APO14

"Managed Data." The description for this objective emphasizes the need to "Classify data in accordance with its business criticality." This directly links the classification process to the data's importance to business operations

which is a core component of business risk assessment.

3. National Institute of Standards and Technology (NIST)

Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control Family: Program Management (PM)

Control: PM-11

"Mission/Business Process Definition." The guidance notes that understanding mission/business processes is essential for determining information protection needs. This establishes a direct link between business context (and its associated risks) and the application of security controls

which is governed by classification.

The lack of standardized data formats across logs is the most significant concern for an IS auditor. Non-standardized logs severely hinder the ability to aggregate, correlate, and analyze security events across different systems and applications. This makes it extremely difficult, if not impossible, to perform effective automated monitoring, trace the sequence of events during a security incident, or conduct meaningful forensic analysis. This fundamental flaw undermines the primary purpose of log management, which is to provide a coherent and actionable view of operational and security-related activities throughout the IT environment.

A. Growing log file size is an expected operational trend, primarily representing a capacity and retention policy issue, not a fundamental control weakness.

B. Logging critical events to immutable files is a security best practice that ensures log integrity and is considered a control strength, not a concern.

C. It is common and often necessary for complex applications to generate multiple log files for different functions; this is manageable with proper log aggregation tools.

1. ISACA. (2019). CISA Review Manual

27th Edition. Page 238. The manual states that for logs to be useful for analysis and to create a proper audit trail

they should be "in a consistent format." A lack of standardization directly violates this principle.

2. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-92: Guide to Computer Security Log Management. Section 3.1.2

"Log Generation." This guide explicitly states

"Organizations should also establish standardized log formats

such as the same timestamp format

for all logs. Standardization makes it much easier to perform automated log analysis."

3. Kent

K.

& Souppaya

M. (2006). The challenges of log analysis. CrossTalk

The Journal of Defense Software Engineering

19(5)

21-25. The article highlights that a major challenge in log analysis is the "lack of a standard logging format

" which complicates the correlation of events from diverse sources.

The principle of integrity in information security ensures that data has not been altered in an unauthorized manner. A log that cannot be modified (i.e., is immutable or write-once) provides the highest level of assurance that its contents are original, accurate, and trustworthy. This is a fundamental preventive control for maintaining the evidentiary value of logs. While other options are good security practices, they do not directly guarantee that the log data itself has not been tampered with. Immutability is the most direct and effective control for assuring log integrity.

A. Reviewing logs is a detective control used to identify anomalies after they occur; it does not prevent the log from being altered beforehand.

B. Authorized access is a control primarily for confidentiality. An authorized user with modification privileges could still alter the log, compromising its integrity.

D. Retaining logs according to policy ensures their availability for future analysis and meets compliance requirements, but it does not protect the content from modification.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Task Statement 4.5. The manual emphasizes that for logs to be effective for forensic analysis

their integrity must be maintained. It discusses techniques such as writing logs to write-once

read-many (WORM) devices or a separate

secured log server to prevent modification.

2. National Institute of Standards and Technology (NIST) Special Publication 800-92

"Guide to Computer Security Log Management." Section 3.3

"Log Storage and Disposal

" states

"Protecting log information from unauthorized modification and destruction is critical for preserving its integrity." It recommends storing logs on a separate

dedicated log server with restricted access and using append-only mechanisms to prevent alteration of existing log data.

3. ISACA

IT Audit

Control

and Security

by Robert R. Moeller (2009). Chapter 16

"Auditing Firewalls

Extranets

and Other Network Security Systems." The text discusses the importance of firewall logs as an audit trail and highlights that their value is contingent on controls that prevent tampering

such as remote logging to a secure

write-protected server. This directly supports the concept that immutability is the key to integrity.

The absence of audit logging is the greatest concern because it represents a fundamental failure of accountability and traceability. In a shared system like a CRM, which contains sensitive customer data, it is critical to know who accessed or modified information and when. Without audit logs, it is impossible to detect unauthorized activities, investigate security incidents, or hold individuals accountable for their actions. This lack of a detective and deterrent control undermines the entire access control structure, rendering other controls less effective.

A. The absence of single sign-on is an inconvenience and a potential efficiency loss, but not a critical failure if other authentication controls are strong.

C. An inconsistent security baseline is a significant risk, but its impact may be localized, whereas the lack of logging affects accountability across the entire system.

D. Not requiring complex passwords is a serious vulnerability that increases the risk of unauthorized access, but the lack of logging makes it impossible to even detect or investigate such an access.

1. ISACA

CISA Review Manual

27th Edition. Chapter 4

Section 4.5.3

"Monitoring and Log Management." The manual states

"Logs are records of events that have occurred on a system. They are important for establishing accountability

reconstructing events

detecting intrusions and problem-solving." It further explains that without logs

"it may be impossible to determine...the extent of an intrusion." This highlights that a lack of logging is a critical failure in security monitoring and accountability.

2. ISACA

CobiT 5: Enabling Processes. APO12

Manage Risk

and DSS05

Manage Security Services. Specifically

DSS05.07

"Monitor the infrastructure for security-related events

" emphasizes the need to collect and analyze security logs to identify malicious activity and incidents. The absence of logging makes this entire control practice impossible to implement.

3. Purdue University

"Information System Auditing" Courseware. In modules discussing logical access controls

the principle of accountability is stressed as a cornerstone. Audit trails (logs) are presented as the primary mechanism for enforcing accountability by creating a record of user actions that can be traced back to a specific individual. (Reference to general principles taught in such courses

e.g.

Purdue Global IT 540).

A voltage regulator is a device specifically designed to automatically maintain a constant voltage level. In an environment susceptible to unexpected increases in power, such as voltage surges or spikes, a voltage regulator actively conditions the incoming power. It suppresses excessive voltage and boosts insufficient voltage, ensuring that the connected system receives a stable and clean power supply. This direct management of voltage fluctuations makes it the most effective protective measure against the specific threat described, preventing damage to sensitive electronic components.

A. A generator is a backup power source used during a complete power failure (blackout); it does not protect against fluctuations from the primary power line.

C. A circuit breaker is a safety device that interrupts current flow during an overload or short circuit, primarily protecting against fire hazards, not voltage spikes.

D. An alternate power supply line provides redundancy for power availability but offers no inherent protection against power quality issues like surges affecting the grid.

1. ISACA CISA Review Manual

27th Edition. Domain 4: Information Technology Operations

Section 4.4.1 Hardware Maintenance and Monitoring. The manual states

"Power conditioners and surge protectors should be used to protect against power fluctuations... An uninterruptible power supply (UPS) provides short-term backup power from batteries... and also provides protection against power surges." A voltage regulator is a primary type of power conditioner.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5. Security and Privacy Controls for Information Systems and Organizations

Control PE-11: Alternate Power Equipment. The discussion notes mention the use of "power line conditioners" as a control to ensure stable power for systems

distinguishing them from sources like generators which address outages.

3. Kizza

J. M. (2017). Guide to Computer Network Security. Springer. Chapter 12: Physical and Environmental Security. Section 12.2.2 Power Supply. The text explains that "power conditioners

including voltage regulators and surge suppressors

filter the power

protecting equipment from spikes

surges

and noise." This directly supports the function of a voltage regulator in protecting against power increases. (DOI not applicable for entire book

but concept is standard in academic texts on this topic).

Data architecture provides the most comprehensive information for understanding a transaction audit trail. It defines the structure, relationships, and management of all data within the application, including how transaction data is captured, stored, and linked to user activities, timestamps, and other relevant events. This holistic blueprint allows an IS auditor to understand the entire lifecycle of a transaction's data, which is the essence of an audit trail, rather than just viewing a single process or file structure in isolation.

A. System/process flowchart: This illustrates the flow of operations but lacks the specific detail about the data elements that are captured and stored in the audit trail.

B. File layouts: This is too specific, as it only describes the structure of flat files. Modern online applications typically use databases, and this option would not describe the relational structure.

D. Source code documentation: This provides a highly granular, implementation-level view. It is inefficient for an auditor to review code to understand the overall audit trail design and data relationships.

1. ISACA

CISA Review Manual

27th Edition

2019. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.3.5 Data Files

states the importance of understanding the "application system’s data structure and file organization" to test application controls. Data architecture documentation provides this comprehensive view

which is essential for evaluating the completeness and accuracy of an audit trail.

2. Spewak

S. H.

& Hill

S. C. (1992). Enterprise Architecture Planning: Developing a Blueprint for Data

Applications

and Technology. While a foundational text

its principles are core to IS audit. Chapter 3

"Data Architecture

" explains that this architecture defines the major kinds and types of data and their interrelationships. An audit trail is a kind of data

and its relationship to transaction data is defined within the data architecture.

3. Zachman

J. A. (1987). A framework for information systems architecture. IBM Systems Journal

26(3)

276-292. The Zachman Framework

a seminal work in enterprise architecture

defines the "Data" column (the "What") as a core component of understanding a system. An audit trail is fundamentally about data—what happened

what data was affected

etc. The data architecture provides this perspective

detailing the entity-relationship models necessary to trace transactions. (DOI: 10.1147/sj.263.0276)

The most critical factor in the validity and reliability of any machine learning (ML) model is the quality of the data used for its training. The principle of "Garbage In, Garbage Out" (GIGO) is fundamental here. If the training data is sourced from an unreliable provider, it may be inaccurate, biased, or incomplete. This foundational flaw will be learned and amplified by the model, rendering its predictions untrustworthy, regardless of how well it is designed or tested. An IS auditor's primary concern is to ensure the integrity and reliability of the system's foundation, which for an ML model, is its training data.

A. A decrease in accuracy on a different population indicates a generalization problem, which is a concern, but it is a performance symptom, not a foundational flaw like unreliable source data.

C. The use of open-source programming languages (e.g., Python, R) is a standard, accepted, and prevalent practice in ML development and does not represent an inherent risk.

D. Testing a model with a holdout dataset drawn from the same population as the training data is a correct and standard procedure for validating model performance.

1. ISACA

"Auditing Artificial Intelligence" White Paper

2019: Page 13

under the "Data" section

states

"The quality of the data used to train the AI system is critical to its performance... The GIGO (garbage in

garbage out) principle applies. If the data used to train the system is biased

incomplete or of poor quality

the system will not perform as expected." This directly identifies data quality and source as a critical audit concern.

2. Munoko

I.

Brown-Liburd

H. and Vasarhelyi

M. "Auditing machine learning models: A framework for auditors and data scientists." Managerial Auditing Journal

Vol. 35 No. 5

2020

pp. 649-667: In Section 3.1

"Data Understanding

" the framework emphasizes that a key audit step is to "assess the reliability of the data source" and evaluate the data collection process to ensure data quality. This highlights the primacy of the data source in an ML audit. (DOI: https://doi.org/10.1108/MAJ-08-2019-2382)

3. ISACA

"A Framework for Auditing AI

" ISACA Journal

Volume 6

2019: The article outlines an audit approach where a primary step is to "understand and assess the data used by the AI." It specifies that the "auditor should verify the source

lineage and quality of the data

" reinforcing that the data's origin is a top-priority audit point.

During the planning phase of acquiring any new system, especially a cloud-based platform, the most critical initial determination is the classification of data that will be stored and processed. This decision is foundational as it directly influences all other security, compliance, and operational considerations. Understanding the data's sensitivity (e.g., public, confidential, restricted) dictates the required level of security controls, data residency and sovereignty requirements, and applicable legal or regulatory obligations (e.g., GDPR, HIPAA). This strategic decision precedes and informs the tactical design of access controls, user lifecycle management, and auditing procedures.

A. Role-based access control (RBAC) policies are a specific security control mechanism. The design and stringency of these policies are a direct consequence of the types of data the platform will manage, not the primary planning decision.

C. Processes for on-boarding and off-boarding users are operational procedures. While crucial for security, they are defined and implemented based on the security requirements established from the data classification and risk assessment.

D. Processes for reviewing administrator activity are a detective control. The need for and frequency of such reviews are determined by the risk level associated with the platform, which is primarily defined by the sensitivity of the data it holds.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 5.3.3 Data Classification. The manual emphasizes that data classification is a prerequisite for applying appropriate security controls. It states

"The objective of classifying information is to ensure that information assets receive an appropriate level of protection." This principle is most critical during the initial planning and requirements definition phase of an acquisition.

2. NIST Special Publication 800-144

Guidelines on Security and Privacy in Public Cloud Computing. Section 5.2.1

"Information and Data

" states

"The type of information processed

stored

and transmitted by a system is a primary factor in determining the security and privacy requirements for the system." This highlights that understanding the data is the foundational first step in planning for cloud adoption.

3. COBIT 2019 Framework: Governance and Management Objectives

ISACA. The management objective APO14 Managed Data includes the key practice APO14.02

"Define and maintain a data classification scheme." The framework guidance indicates that this classification

based on business needs and criticality

is essential to "allow for the application of appropriate controls." This is a fundamental governance activity that must be addressed in the planning phase.

According to established incident response frameworks, the phase immediately following the detection and analysis of an incident is containment. The primary objective of the containment phase is to stop the incident from spreading and to limit its impact on business operations and data. By focusing on limiting the damage, the incident response team takes immediate, necessary actions—such as isolating the affected network subnet—to prevent the virus from propagating further. This step is critical and must be performed before any attempts at eradication or recovery to ensure the problem does not escalate.

A. Verifying that the compromised systems are fully functional is a step within the recovery phase, which occurs after the threat has been contained and eradicated.

C. While documentation is a continuous process, the immediate tactical priority after identifying an outbreak is containment, not comprehensive documentation.

D. Removing the virus (eradication) and restoring systems (recovery) are subsequent phases that should only be initiated after the incident has been successfully contained.

1. Cichonski

P.

Millar

T.

Grance

T.

& Scarfone

K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61

Rev. 2). National Institute of Standards and Technology. Section 3.3

"Containment

Eradication

and Recovery

" states

"Containment is the first step in this phase... Containment is important before an incident overwhelms resources or increases damage." (p. 26). https://doi.org/10.6028/NIST.SP.800-61r2

2. ISACA. (2019). CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience. The manual outlines the incident management process

emphasizing that after detection and analysis

the immediate response is to contain the incident to limit the extent of the damage.

3. Carnegie Mellon University Software Engineering Institute. (2017). CSIRT Services. "Containment: Limiting the scope and magnitude of the event." This is listed as a primary service and a critical step in the incident handling process

following initial analysis. Retrieved from https://resources.sei.cmu.edu/assetfiles/WhitePaper/2017019001503734.pdf (p. 5).

The primary risk in this scenario is the inaccurate manual transcription of totals from a source document (spreadsheet) to a target system (job-costing system). Reconciliation is a detective control that directly addresses this risk by comparing the totals from the source with the totals entered into the system. This control provides the highest level of assurance that the overall data transfer was accurate and complete. While other controls are useful, reconciliation is the most effective method for verifying that the final, aggregated figures in the system match the source.

B. Validity checks only ensure the correct data type is entered (e.g., numeric vs. character) but do not verify the accuracy of the number itself.

C. Reasonableness checks only confirm that an entered value falls within a plausible range, not that it precisely matches the source document.

D. Displaying entered data for visual verification is a weak control because it relies on the data entry person to notice their own error.

1. ISACA. (2019). CISA Review Manual

27th Edition. Schaumburg

IL: ISACA. In Domain 3: Information Systems Acquisition

Development

and Implementation

the section on Application Controls describes reconciliation as a key control to "ensure that data is complete and accurate throughout its processing." It specifically contrasts this with input controls like validity and reasonableness checks

which are preventive but do not guarantee accuracy against a source document.

2. Weber

R. (2012). Information Systems Control and Audit. Pearson. Chapter 12

"Auditing Computer Applications I

" explains that while input validation controls (like validity and reasonableness checks) are important preventive measures

detective controls such as reconciliations are essential for ensuring the accuracy and completeness of data that has been processed. Comparing source data totals to processed totals is presented as a fundamental reconciliation technique.

3. Singleton

T. (2013). IT Auditing and Application Controls for Small and Mid-Sized Enterprises. ISACA Journal

Volume 5. This article emphasizes that for manual data entry processes

reconciliations are a critical compensating control to detect errors that preventive input controls may miss

thereby ensuring data integrity between different stages of processing.

The best indication that a project is on track is the successful completion of critical, late-stage milestones within the planned schedule. User acceptance testing (UAT) is one of the final phases before implementation. Successfully identifying and addressing issues discovered during UAT prior to the original go-live date demonstrates that the project has progressed through development and earlier testing phases on time and is effectively managing the final pre-deployment activities. This provides tangible evidence of progress and readiness, unlike planning or communication activities, which do not reflect the project's actual status.

A. This is an essential early-stage planning activity. Completing it does not guarantee that subsequent development and testing phases will remain on schedule.

B. Documenting due dates is part of the initial project plan. It represents the intended schedule, not the actual progress against that schedule.

D. Communicating a go-live date is a project management task, not an indicator of progress. The project could be significantly behind schedule despite this communication.

1. ISACA

CISA Review Manual

27th Edition (2019)

Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.4.5 Testing. This section details the different levels of testing

positioning User Acceptance Testing (UAT) as the final phase of testing to ensure the system is acceptable to the end users before it is placed into production. Successful resolution of UAT issues is a critical gate for implementation

making it a key indicator of project readiness and adherence to schedule.

2. ISACA

CISA Review Manual

27th Edition (2019)

Domain 2: Governance and Management of IT

Section 2.6 Project Management. This section emphasizes the importance of monitoring and controlling project performance by measuring progress against the project plan. The successful completion of a major milestone like UAT is a primary metric for assessing whether a project is on track.

3. McConnell

S. (2004). Code Complete: A Practical Handbook of Software Construction (2nd ed.). Microsoft Press. Chapter 20

"The Software-Quality Landscape." While not an ISACA-specific source

this foundational software engineering text is widely used in university curricula. It discusses the importance of late-stage testing (like UAT) in validating software quality and readiness for release. The rate of defect discovery and resolution during this phase is a key indicator of project health and proximity to completion.

The IS auditor's conclusions must be based on sufficient, reliable, and relevant evidence gathered through independent testing. When management provides new evidence after the initial fieldwork but before the final report is issued, the auditor has a professional responsibility to validate this new information. Simply accepting management's assertion or evidence without verification would compromise the auditor's objectivity and due professional care. Therefore, the best course of action is to re-perform the specific audit tests related to the control in question. This allows the auditor to independently verify that the control has been implemented and is operating effectively, ensuring the final audit report is accurate and based on verified facts.

A. Explaining that the control will be evaluated during follow-up is a viable option, but not the best, as it results in a report that does not reflect the most current, verifiable state of the control environment.

C. Changing the conclusion based solely on evidence provided by management, without independent verification, is a violation of professional standards for objectivity and due care.

D. Adding comments about management's action is a good reporting practice, but it is insufficient. The auditor must first validate the claim before modifying the report's primary conclusion on the control's effectiveness.

---

1. ISACA

ITAF: A Professional Practices Framework for IS Audit/Assurance

4th Edition

2020.

Guideline 2204 Evidence

Section 2204.3 Evaluation of Evidence: States

"IS auditors should evaluate the evidence gathered to determine whether it is sufficient and appropriate to support the conclusions to be drawn." This implies that evidence from management must be evaluated by the auditor

which is best done through re-performance of tests.

Guideline 2401 Reporting

Section 2401.8 Subsequent Events: Notes that the IS auditor should consider the effect of events occurring between the end of fieldwork and the date of the report. If management implements a control in this period

the auditor should perform procedures to determine the effect of this event on the findings and report. Re-testing (re-performing the audit) is the appropriate procedure.

2. ISACA

CISA Review Manual

27th Edition

2019.

Chapter 1: The Process of Auditing Information Systems

Section 1.4.4

"Reporting/Communication of Results": This section emphasizes that all audit findings must be supported by sufficient and appropriate evidence. If new evidence is presented that contradicts a finding

the auditor must re-evaluate. The most rigorous method of re-evaluation is to re-test the control. The manual states

"The IS auditor should obtain sufficient and appropriate evidence to draw reasonable conclusions on which to base the audit results." Accepting management's evidence without re-performance would not meet this standard.

Data classification is a fundamental component of a risk-based information security program. The BEST source for determining the appropriate classification for new data is a risk assessment. This process evaluates the data's value, sensitivity, and criticality by analyzing the potential impact (e.g., financial, operational, reputational, legal) on the organization if its confidentiality, integrity, or availability were to be compromised. The outcome of this impact analysis directly informs the assignment of a classification level (e.g., Confidential, Restricted), which in turn dictates the necessary security controls.

A. Input by data custodians: Data custodians are responsible for implementing and maintaining security controls, not for determining the classification level, which is the responsibility of the data owner.

B. Security policy requirements: The security policy establishes the framework and defines the available classification levels, but it does not determine the specific classification for a particular data set.

D. Current level of protection: The classification of data should dictate the required level of protection, not the other way around. Basing classification on existing controls is a reactive and flawed approach.

1. ISACA

CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.4.3 Data Classification. The manual explains that data classification is based on the data's criticality and sensitivity to the organization

which are key outputs of a risk assessment process.

2. ISACA

"Data Classification: A Prerequisite for Effective Information Protection and Governance

" White Paper

2019. Page 4 states

"The classification of data is based on its level of sensitivity and the impact to the organization should that data be disclosed

altered or destroyed without authorization." This impact assessment is the core of a risk assessment.

3. National Institute of Standards and Technology (NIST)

Federal Information Processing Standards (FIPS) Publication 199

"Standards for Security Categorization of Federal Information and Information Systems

" February 2004. Section 2

"Purpose

" and Section 3.1

"Security Categorization

" specify that the categorization (classification) of information is determined by assessing the potential impact of a loss of confidentiality

integrity

or availability. This is a foundational activity within risk management.