CISA. Set it up and run it.

1. Refer to the exhibit. An auditor reviews an extract from a continuous-monitoring dashboard. What does this finding most likely indicate about the control environment?

• A. The monitoring rule is misconfigured and should be disabled
• B. The control fully prevents duplicate payments
• C. No finding exists because the alerts are logged
• D. Detective alerts are generated but not acted upon

Correct answer: D. The monitoring rule is producing detective alerts, but with thirty-seven flagged matches unreviewed for up to sixty-two days the follow-up process has broken down, so the control detects the risk yet does nothing to correct it.

Why the others are wrong. Nothing suggests the rule is misconfigured; it is correctly flagging duplicates, so disabling it would remove needed detection. The control is detective, not preventive, so it cannot claim to fully prevent duplicate payments. Concluding no finding exists because alerts are logged ignores that alerts nobody acts on leave the risk open.

2. An auditor is mapping activities to either the IT governance layer or the IT management layer. Identify the two activities that belong to governance rather than management. (Choose two.)

• A. Deploying patches to production servers on a monthly cadence
• B. Resetting user passwords through the service-desk queue
• C. Configuring firewall rules to segment the internal network
• D. Approving the enterprise risk appetite for technology investments
• E. Overseeing that IT strategy stays aligned with business goals

Correct answer: D. Approving risk appetite and overseeing strategic alignment are evaluate-and-direct activities the governance body owns; they set direction and monitor outcomes. The remaining choices are execution tasks that management performs to run IT day to day, not to direct it.

Why the others are wrong. Deploying patches, resetting passwords, and configuring firewall rules are operational execution tasks owned by IT management and staff. They implement decisions rather than set direction or provide oversight. Classifying any of them as governance confuses running IT with directing and monitoring it, which is the core distinction.

3. An IS auditor is unsure whether ISACA's audit standards must be followed or are merely recommended for guidance. What is the correct understanding of ITAF standards?

• A. Standards are optional practices that auditors may adopt at their discretion
• B. Standards are mandatory requirements for the conduct of IS audit work
• C. Standards apply only to external auditors, not internal audit staff
• D. Standards take effect only after a regulator formally adopts them

Correct answer: B. Under ISACA's ITAF, audit standards are mandatory and define the minimum level of acceptable performance required to meet professional responsibilities; guidelines and tools and techniques provide non-mandatory guidance on how those standards may be applied.

Why the others are wrong. Calling the standards optional contradicts ITAF, which distinguishes mandatory standards from discretionary guidelines. They bind both internal and external practitioners performing IS assurance, not external auditors alone. And they are effective as issued by ISACA, so no regulatory adoption is required to make them applicable to members and certification holders.

4. A newly appointed board wants to clarify its role in IT governance versus the responsibilities of the executive management team. What best describes the board's governance role?

• A. Configuring the systems that support IT service delivery day to day
• B. Setting direction and overseeing that IT delivers value and manages risk
• C. Writing the operational procedures that IT staff follow each shift
• D. Executing project plans and allocating individual staff to tasks

Correct answer: B. Governance is the board's responsibility: it sets strategic direction, defines the risk appetite, and oversees that management delivers value from IT while keeping risk within tolerance. The board directs and monitors rather than performing the work itself.

Why the others are wrong. Configuring systems, writing operational procedures, and executing project plans are all management activities that implement and run IT within the direction the board sets. Allocating staff to tasks is likewise a management execution role. Confusing these hands-on responsibilities with governance blurs the essential separation between directing and doing.

5. A project to replace the payroll system began development before management approved a business case. What is the auditor's GREATEST concern?

• A. Developers chose an unfamiliar programming language
• B. The project schedule spans two fiscal years
• C. Expenditure was committed without documented justification or approval
• D. Testing will occur late in the project

Correct answer: C. Committing project spending before an approved business case exists means the investment was never justified against its costs, benefits, and alternatives, so management cannot show the initiative aligns with strategy or represents a sound use of funds.

Why the others are wrong. The programming language chosen is a delivery detail, not a governance failure. A schedule that spans two fiscal years is normal for large efforts and is not itself a concern. Late testing is a separate quality risk, and none of these outweighs spending money with no approved justification behind the project.

6. An IS auditor reviewing IT operations finds the hardware asset inventory was last reconciled two years ago and omits several production servers deployed since. What is the GREATEST concern?

• A. Undocumented assets fall outside patching and monitoring controls
• B. Procurement records show the servers cost more than budgeted
• C. The inventory file was built in an old spreadsheet template
• D. Asset tags on the servers use an inconsistent label format

Correct answer: A. Assets missing from the inventory are not tracked by patch, configuration, or monitoring processes, so they can run unsupported software and remain exposed without anyone owning or remediating the resulting risk.

Why the others are wrong. Servers costing more than budgeted is a procurement variance, not an operational control gap. An old spreadsheet template affects presentation, not completeness. Inconsistent asset tag labels are a minor housekeeping issue. None carries the risk that untracked assets escape security and maintenance controls entirely.

7. An IS auditor reviews an information security policy and finds it was approved by the IT operations manager rather than executive management. What is the auditor's primary concern?

• A. The policy was written in overly technical language
• B. The policy has not been distributed to all staff
• C. The policy lacks senior management authority and commitment
• D. The policy does not reference an industry framework

Correct answer: C. An information security policy must be approved and sponsored by senior or executive management so it carries organizational authority; approval by an operations manager alone means the policy lacks the mandate needed to compel enterprise-wide compliance.

Why the others are wrong. Technical language is a readability issue, not a governance failure. Non-distribution is a rollout gap that follows approval rather than replacing it. Failing to reference a framework is a minor documentation weakness. None matches the fundamental problem that the policy lacks legitimate executive endorsement.

8. An IS auditor is assigned to review an access-control system that the same auditor personally designed and implemented two years ago. What is the auditor's BEST course of action?

• A. Disclose the conflict and decline or have another auditor perform the review
• B. Proceed, since the prior design work improves audit efficiency
• C. Review only the parts of the system built by other staff
• D. Complete the audit but omit the self-designed components from the report

Correct answer: A. Auditing a control one designed and implemented is a self-review threat that impairs independence; the auditor should disclose the impairment and arrange for an independent party to perform the review so objectivity remains intact.

Why the others are wrong. Proceeding for efficiency ignores that familiarity with one's own work biases judgment. Reviewing only others' portions still leaves the auditor assessing an environment shaped by their design and does not remove the self-review threat. Omitting the self-designed components from the report conceals the very areas most exposed to bias and misleads report users.