The internal audit department wants to monitor the effectiveness and efficiency of its audit processes. The CAE is considering several metrics. Which metric is most directly related to the quality of audit reports?

Number of audit findings that are later overturned or disputed by management

Average time taken to complete an audit from planning to report issuance

Results of stakeholder surveys that assess the clarity, usefulness, and accuracy of audit reports

Percentage of audit recommendations accepted by management

The internal audit department is planning its first external quality assessment. The CAE is concerned about the cost and the potential disruption to the audit schedule. Which approach best balances the need for an external assessment with these constraints?

Perform a self-assessment and skip the external assessment to save costs.

Conduct a full external assessment during the busiest audit period to get it done quickly.

Ask the external auditor of the company to perform the assessment for free as part of their existing engagement.

Schedule the external assessment during a period of lower audit activity and use a qualified external assessor, even if it requires some budget allocation.

During an audit of a healthcare organization's patient portal, the IS auditor discovered that the system does not encrypt data in transit, exposing patient information to potential interception. The auditor is writing the report and wants to communicate the risk effectively to the board, which includes non-technical members. Which approach best achieves clear and objective communication?

Describe the finding in business terms, explaining the potential for patient data exposure and the resulting legal and reputational impact.

Use technical jargon such as 'TLS termination' and 'cipher suite misconfiguration' to demonstrate expertise.

State that the system is 'insecure' without further explanation to keep the report concise.

Avoid mentioning the finding because the board is not responsible for technical details.

What is the primary purpose of documenting management action plans in an audit report?

To assign blame for the audit findings

To provide a record of management's commitment to address audit findings

To replace the need for further audit testing

To satisfy regulatory requirements for all audits

Which of the following is a key technique for clearly communicating audit findings to stakeholders?

Including as much detail as possible in every finding

Structuring findings with a clear condition, criteria, cause, and effect

Using technical jargon to demonstrate expertise

Focusing only on positive findings to maintain good relationships

Certified Information Systems Auditor

Domain 1Objective 4

Audit Reporting and Quality CISA Practice Questions (Page 4)

Part of the Information Systems Auditing Process domain, which accounts for 18% of the CISA exam.

31questions here

7free pages

7concepts

18%of the exam

Questions 16–20

16application · medium
The internal audit department wants to monitor the effectiveness and efficiency of its audit processes. The CAE is considering several metrics. Which metric is most directly related to the quality of audit reports?
Select an answer first
17expert · hard
The internal audit department is planning its first external quality assessment. The CAE is concerned about the cost and the potential disruption to the audit schedule. Which approach best balances the need for an external assessment with these constraints?
Select an answer first
18application · medium
During an audit of a healthcare organization's patient portal, the IS auditor discovered that the system does not encrypt data in transit, exposing patient information to potential interception. The auditor is writing the report and wants to communicate the risk effectively to the board, which includes non-technical members. Which approach best achieves clear and objective communication?
Select an answer first
19foundation · easy
What is the primary purpose of documenting management action plans in an audit report?
Select an answer first
20foundation · easy
Which of the following is a key technique for clearly communicating audit findings to stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.