CISA Sample Questions and the Passing Score, Explained

The passing score, before the questions

CISA results are reported on a scaled score from 200 to 800, and you need 450 to pass. Two clarifications matter more than the number itself. First, 450 is not a percentage — it does not mean 45%, or 56%, or any fixed share of questions answered correctly. ISACA scales scores across exam forms so that small differences in form difficulty even out; nobody outside ISACA can convert 450 into "get X questions right," and any site that does is guessing. Second, the format: 150 multiple-choice questions in 4 hours, which is 96 seconds per question — a pacing fact that shapes how you should practise, as the closing section explains.

The five questions below are original, written for this post in CISA's style. That style has a signature: on most items, several options are defensible, and the credited answer is the one ISACA's doctrine — independence, risk ownership, evidence quality — selects as the BEST. Learning to spot which principle is doing the deciding is the real skill the exam measures.

Five worked sample questions

Sample question 1. During a walkthrough of the payments process, an IS auditor discovers that one employee can both create a new vendor and approve payments to that vendor, and that two payments went to a vendor with no matching purchase order. What should the auditor do FIRST?

• A. Recommend that the control be redesigned and follow up at the next scheduled audit
• B. Report the finding and its risk promptly to audit management
• C. Personally re-perform a review of every payment made to that vendor over the past year
• D. Instruct the process owner to suspend the employee's system access immediately

Correct answer: B. A significant finding with a live fraud indicator goes up the audit reporting line first — audit management decides on escalation, scope changes and whether other parties (such as an investigations function) get involved. Option C is the strongest distractor because digging deeper feels diligent, but unilaterally expanding the engagement before reporting distorts priorities and can even compromise a later investigation. Option D has the auditor directing operations, which destroys audit independence, and option A buries an active red flag inside a routine recommendation cycle.

Sample question 2. An organisation processes roughly two million invoices a year through a fully automated three-way matching control. To test whether this control operated effectively throughout the year, which approach is MOST appropriate for the IS auditor?

• A. Manually re-perform the matching for every invoice in the population
• B. Verify the control's configuration and change history, then test a sample of transactions across the period
• C. Inspect one invoice from each month of the year
• D. Rely on management's monitoring dashboard without performing any testing

Correct answer: B. An automated control behaves the same way on every transaction if its configuration is correct and unchanged — so the auditor tests the configuration, the change control around it, and a sample spread across the period (attribute sampling) to confirm consistent operation. Option A is the strongest distractor because total re-performance sounds thorough; in practice it is infeasible at this volume and misunderstands what makes an automated control reliable. Option C is an arbitrary sample with no basis, and option D is not evidence at all.

Sample question 3. A business unit head asks the IS auditor to co-sign the acceptance of a high residual risk so a project can launch on schedule. What should the auditor do?

• A. Accept the risk jointly with the business unit so the project is not delayed
• B. Refuse, and block the launch until the risk has been remediated
• C. Make clear that risk acceptance is management's decision, document the audit assessment, and ensure the acceptance is recorded at the appropriate organisational level
• D. Accept the risk, but record a reservation in the audit file

Correct answer: C. Risk acceptance belongs to senior management and the business owner — the people who own the consequences. The auditor's role is to assess, advise and document, never to own the acceptance. Options A and D are the dangerous distractors because they feel cooperative, but an auditor who accepts a risk can no longer independently audit it later. Option B overreaches in the opposite direction: auditors recommend; they hold no authority to block business operations.

Sample question 4. Which of the following pieces of audit evidence is MOST reliable?

• A. A system-generated exception report printed by the audited department and handed to the auditor
• B. A bank confirmation obtained directly by the auditor from the organisation's bank
• C. A verbal explanation from the process owner describing how a control operates
• D. An internally prepared spreadsheet reconciling two account balances

Correct answer: B. Evidence reliability follows a hierarchy: externally generated evidence obtained directly by the auditor sits at the top, because it never passed through the auditee's hands. Option A is the strongest distractor — "system-generated" sounds objective — but once the auditee prints and hands it over, its completeness and integrity are unverified; the same report extracted by the auditor would rank far higher. Option D is internal and preparer-controlled, and option C, verbal explanation, is the weakest form of evidence there is.

Sample question 5. A post-implementation review finds that a new system was delivered on time, works exactly as specified, and users were fully trained — yet the expected cost savings never materialised, because the transaction-volume assumptions behind the business case were unrealistic. The root cause MOST likely lies in a weakness during which phase?

• A. Operations and ongoing support
• B. System testing
• C. Requirements definition and development of the business case
• D. User training and changeover

Correct answer: C. Benefits live or die in the business case. Unrealistic assumptions were baked in before anything was built, and every later phase executed faithfully against them. Notice how the stem eliminates the distractors: the system "works exactly as specified," so testing (B) demonstrably did its job; users were "fully trained," removing D; and operations (A) — the instinctive blame target — inherited a shortfall it did not create. CISA rewards tracing a benefit failure back to feasibility and requirements discipline, not blaming the team closest to the outcome.

How to practise in CISA's style

Drill doctrine, not answers. For every practice item you work, say out loud which principle decides it — independence, risk ownership by management, the evidence hierarchy, control design versus control operation — before you look at the key. This is the discipline ISACA's own QAE-style material teaches, and it transfers to questions you have never seen, which memorised answers never do.

Then train the clock. One hundred and fifty questions in 240 minutes is 96 seconds each, and long scenario stems punish re-reading: practise one careful read, a doctrine call, and move on. Finally, respect the stamina variable. Judgement quality in hour four is what this exam actually measures, so sit at least two full-length, four-hour timed mocks before exam day. Timed, domain-scored free practice tests on Study4Pass can help you rehearse that pacing — what matters is that the rehearsal matches the real sitting's length and discipline. Beyond the exam itself, it is also worth knowing the average salary for CISA holders and the CISA retake policy if a first attempt falls short.