CISA Exam Dumps - Certified Information Systems Auditor

To efficiently detectduplicate payments,data analyticsand automated checks are required due to thehigh volume of transactions.

Option A (Correct):Computer-Assisted Audit Techniques (CAATs)allow auditors toautomatically scan large datasetsfor duplicate payments based oninvoice numbers, vendor names, and payment amounts.

Option B (Incorrect):Stratified samplinggroups data into categories, which helps in analysis but doesnot directly detect duplicates.

Option C (Incorrect):Statistical samplingis useful forextrapolating results, but it doesnot systematically findduplicate transactions.

Option D (Incorrect):Process walk-throughsreview procedures but donot analyze transactions at scale.

 A service level agreement (SLA) is a contract between a service provider and a customer that defines the expected level of performance, risks, and capabilities of an IT infrastructure. An IS auditor can use an SLA to measure how well the IT infrastructure meets the business needs and objectives, as well as to identify any gaps or issues that need to be addressed. The other options are not directly related to measuring the performance, risks, and capabilities of an IT infrastructure. References:

CISA Review Manual (Digital Version), Chapter 5, Section 5.2.11

CISA Review Questions, Answers and Explanations Database, Question ID 203

The primary benefit of using a dry-pipe fire-suppression system rather than a wet-pipe system is that a dry-pipe system has a decreased risk of leakage, as the pipes are filled with pressurized air or nitrogen instead of water until the system is activated. A wet-pipe system has a higher risk of leakage, corrosion, and freezing. A dry-pipe system is not more effective at suppressing flames, as it uses the same water-based suppressant as a wet-pipe system. A dry-pipe system does not allow more time to abort release of the suppressant, as it has a delay of only a few seconds before the water is released. A dry-pipe system does not disperse dry chemical suppressants exclusively, as it uses water as the primary suppressant. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.2.3

The best way to assess the effectiveness of changes made to processes and tools related to an organization’s BCP is to review the full test results of the BCP. Full test results can provide evidence of whether the changes have improved the BCP’s objectives, such as recovery time objectives (RTOs), recovery point objectives (RPOs), and business impact analysis (BIA). The other options are not as effective as reviewing the full test results, as they do not demonstrate the actual performance of the BCP under simulated disaster scenarios. Completed test plans are only documents that outline the scope, objectives, and procedures of the BCP testing, but they do not show the outcomes or issues encountered during the testing. Updated inventory of systems is a component of the BCP that identifies the critical systems and resources required for business continuity, but it does not measure the effectiveness of the BCP changes. Change management processes are controls that ensure that changes to the BCP are authorized, documented, and communicated, but they do not evaluate the impact or benefit of the changes. References: CISA Review Manual (Digital Version), Chapter 4, Section 4.2.3

The auditor’s primary course of action is to evaluate the impact of the partial compliance. When a control is only partially operating as designed, the auditor must first assess significance: what risk remains, what objectives are affected, and whether the deviation is material enough to become a reportable finding. ISACA audit and follow-up guidance emphasizes capturing and following up on significant issues and deficiencies, which implies the need for impact evaluation before deciding on reporting or recommendations.

Option B is correct because evaluating impact is what determines the seriousness of the deficiency and the appropriate audit response. Without understanding the effect of the deviation, the auditor cannot appropriately decide whether to escalate it, report it, or recommend redesign.

Option C is important and usually happens during audit communication, but discussion with control owners is not the primary analytical step. The auditor must first understand the risk and significance of the partial compliance.

Option D is incorrect because not every partial deviation should automatically become a final-report finding. The auditor should first evaluate whether the issue is significant and reportable. ISACA follow-up guidance specifically refers to significant issues/findings.

Option A is also incorrect because recommending redesign may be appropriate later, but only after the auditor understands the impact and whether the problem is design-related, operating-related, or user-adoption-related.

Therefore, B is the best answer because impact evaluation comes before escalation, formal reporting, or redesign recommendations.

References (Official ISACA):

ISACA Journal, Enhancing the Audit Follow-up Process Using COBIT 5 — significant issues/findings should be captured and followed up.

ISACA Journal, An Approach Toward Sarbanes-Oxley ITGC Risk Assessment — supports a risk-based evaluation approach focused on control process areas.

ISACA, How Effective Is Your Cybersecurity Audit — effectiveness depends on evaluating gaps and their implications.