CISA Scenario Questions: How to Read and Answer Them (2026)
Most of the CISA is a reading test. Here is how to find the constraint, the qualifier and the noise in a stem, with three examples taken apart option by option.
- 150Questions
- 4 hoursTime
- 450 / 800Pass mark
- ~1.6 minPer question
- GREATEST concernKey qualifier
Table of Contents
Most CISA questions are not hard because the content is obscure. They are hard because every option describes something a capable IT professional might reasonably do. ISACA builds each item with one key and three distractors, and its own item-writing guide tells writers to make the distractors look right to someone without the experience to see past them. The key is often not the only defensible action; it is the BEST one for an IS auditor at that point in the audit.
So you are answering two questions at once: what is true about the control, and what is the auditor's job right now. Candidates who know the review manual still lose marks by choosing the option that fixes the problem, trusts the auditee's assurance, or reports before the facts are confirmed. This page shows how to read a CISA stem for its role, its qualifier and its noise, using three original worked examples.
The one rule for reading CISA stems
Read every stem as the IS auditor at a specific point in the audit: you identify, evaluate, report and recommend, but you do not implement, approve or decide for management.
Many CISA distractors are good management or engineering actions. They are wrong only because the auditor would be taking ownership of a control they must stay independent of, or acting before the evidence supports it. Holding the auditor's role fixed removes one or two options before you weigh any content.
Read it like this
- Place the stem in the audit cycle: plan, test, report or follow up
- Prefer evidence the auditor obtains or reperforms
- Rank surviving options by risk to business objectives
Not like this
- Pick an option where the auditor builds or fixes the control
- Treat management's assurance as evidence
- Report or escalate before the condition is confirmed
The 5-step decode routine
Run the same five steps on every scenario. The time on each step is a target for a practised reader, not a rule; the order is the part that matters.
- ~15s
Fix the role and the moment
Who acts in the stem: the IS auditor, the audit manager or management? Where are you: planning, fieldwork, reporting or follow-up? The same fact calls for a different answer at each stage.
- ~10s
Read the qualifier as the real question
GREATEST concern asks for the highest-impact risk, BEST evidence for the most reliable proof, FIRST for the earliest correct step, PRIMARY for the main purpose. Answer that question, not a general one about the topic.
- ~15s
Strike the noise
Company size, industry, the vendor or tool in use, a manager's track record and how long a document is rarely change the auditor's answer. Cross them out so they cannot pull you toward a distractor.
- ~20s
Predict before you read the options
Say in a few words what an auditor would do or worry about here. ISACA writes stems so a candidate can start forming the answer before seeing the alternatives, so a sound prediction often lands close to the key.
- ~35s
Eliminate by role, then rank by risk
Remove options where the auditor implements or decides, and options that conclude before the evidence is in. Rank what is left by impact on business objectives and prefer the one that addresses cause over symptom.
Anatomy of a CISA scenario
Every highlighted phrase below is pinned to a note. Four kinds of phrase matter:
- Constrainta hard requirement that eliminates options
- Qualifierthe word that ranks the survivors
- Keywordpoints at a specific service, control or concept
- Noiselooks important, changes nothing
A signed memo is not a test
An IS auditor at a regional logistics company that moved its ERP to a new hosting provider last year1 is testing whether user access is revoked on termination2. The HR director provides a signed memo stating all leavers were removed within one business day3. The audit objective is to conclude on the control's operating effectiveness across the full financial year4. The HR director has been the audit liaison for three years5. The auditor needs the BEST evidence6 for the working papers.
Which of the following provides the BEST evidence that terminated users' access was removed on time?
- 1Noise. Background only. A hosting change could matter in a cloud or vendor question, but this ask is about evidence for one access control.
- 2Keyword. Names the control under test: timely deprovisioning. Good evidence must link real termination dates to real account disable dates.
- 3Constraint. A management representation. It states that the control worked; it does not show it. On its own it cannot be the BEST evidence.
- 4Constraint. Rules out anything that shows only design, such as a policy or procedure. The evidence must cover how the control actually ran through the year.
- 5Noise. A familiarity detail that baits an independence answer. Nothing in the ask concerns objectivity, and no option turns on it.
- 6Qualifier. Ranks evidence by reliability: system-generated or reperformed beats auditee-prepared documents, and both beat inquiry or written assurance.
- AWritten confirmation from the service desk manager that every termination ticket was closed within one dayOutAnother internal representation, just from a second person. A closed ticket is a claim that work was done, not proof that the accounts were disabled.
- BThe documented offboarding procedure and the CIO's approval of itOutShows design and authorization only. The operating-effectiveness constraint asks whether the control actually ran across the year, which a procedure cannot show.
- CA comparison of HR termination dates for the year with account disable dates extracted from the ERP and directoryAnswerEvidence the auditor obtains from system records and tests directly, covering the whole period. It shows what happened rather than what someone says happened, and every exception is measurable.
- DThe HR director's signed memo, since HR is independent of IT administrationOutSitting outside IT does not make HR independent of the auditee. A signed assertion is still inquiry-level evidence, and seniority does not make it more reliable.
The lesson: When the qualifier is BEST evidence, discard anything that is a statement about the control first, then anything that only shows design.
Two more: decode them yourself
Read each one as you would on the day: mark the constraints, find the qualifier, cross out what fails, and commit to a letter before you open the decode.
Four findings, one root cause
An IS auditor is reviewing the disaster recovery plan of an online retailer whose order platform generates most of its revenue. The plan follows a widely used commercial template and runs to 140 pages. The auditor finds that recovery time objectives were set by the IT department without a business impact analysis, the most recent exercise was a tabletop walkthrough, and two numbers in the emergency call tree are out of date. The auditor must rank the findings and lead the report with the GREATEST concern.
Which of the following findings is the GREATEST concern?
- ARecovery time objectives were set by IT without a business impact analysis
- BThe most recent exercise was a tabletop walkthrough rather than a full interruption test
- CTwo numbers in the emergency call tree are out of date
- DThe plan is based on a commercial template rather than written from scratch
Decode it and show the answer
An IS auditor is reviewing the disaster recovery plan1 of an online retailer whose order platform generates most of its revenue2. The plan follows a widely used commercial template and runs to 140 pages3. The auditor finds that recovery time objectives were set by the IT department without a business impact analysis4, the most recent exercise was a tabletop walkthrough5, and two numbers in the emergency call tree are out of date6. The auditor must rank the findings and lead the report with the GREATEST concern7.
- 1Keyword. Sets the scope: recoverability of critical systems. Findings are ranked by how much they threaten recovery of what the business needs.
- 2Keyword. Signals business impact. Anything that could misjudge how fast the order platform must return outranks presentation or housekeeping issues.
- 3Noise. Looks like a quality signal but is not one. Template origin and page count say nothing about whether the content fits this business.
- 4Constraint. The root cause. Without a BIA, recovery priorities and targets are IT's estimate, so procedures and tests may be built on the wrong objectives.
- 5Keyword. A real limitation, but a test only validates the targets it is given. A more rigorous test against unvalidated objectives proves little more.
- 6Noise. A genuine defect that takes minutes to fix. It does not change the ranking; it is there to look like a concrete failure.
- 7Qualifier. Ranks by impact on business objectives. Pick the finding that undermines the plan's purpose, not the most visible defect.
- ARecovery time objectives were set by IT without a business impact analysisAnswerEvery other part of the plan depends on knowing which processes matter most and how quickly they must return. Without a BIA the order platform may be recovered too late even if every step works.
- BThe most recent exercise was a tabletop walkthrough rather than a full interruption testOutWorth reporting, but secondary. Testing checks the plan against its objectives; when the objectives are unvalidated, a harder test does not close the gap. A full interruption test also carries its own risk for a revenue system.
- CTwo numbers in the emergency call tree are out of dateOutConcrete and easy to verify, which makes it feel serious. It is low impact, quick to correct, and does not call the plan's recovery targets into question.
- DThe plan is based on a commercial template rather than written from scratchOutNoise from the stem recycled as an option. Using a template is not a control weakness; what matters is whether the content reflects this business, which points back to the BIA.
The lesson: On GREATEST concern, ask which finding, left alone, would make the others impossible to fix properly; that is usually the root cause.
Asked to run the scripts
An IS auditor is performing a pre-implementation review of a new billing system. Go-live is in two days. The cutover checklist shows no sign-off for data conversion reconciliation. The project manager, who has delivered three similar migrations on time, asks the auditor to run the reconciliation scripts, noting that the auditor knows the legacy system well from last year's audit. The auditor must decide what to do FIRST.
What should the IS auditor do FIRST?
- ARun the reconciliation scripts and document that they were run at the project manager's request
- BRecommend that the steering committee postpone go-live until the reconciliation is signed off
- CReport the missing reconciliation to the audit committee as a high-risk finding
- DDetermine whether the reconciliation was performed and obtain its results
Decode it and show the answer
An IS auditor is performing a pre-implementation review1 of a new billing system. Go-live is in two days2. The cutover checklist shows no sign-off for data conversion reconciliation3. The project manager, who has delivered three similar migrations on time4, asks the auditor to run the reconciliation scripts5, noting that the auditor knows the legacy system well from last year's audit6. The auditor must decide what to do FIRST7.
- 1Keyword. Defines the auditor's output: an independent view on readiness. The auditor evaluates the conversion controls; the project team performs them.
- 2Constraint. Whatever the auditor finds must reach management before go-live, so it cannot wait for the final report. It does not license the auditor to do project work.
- 3Constraint. The stated fact is a missing sign-off, not proof that the reconciliation never happened. The FIRST step has to close that gap.
- 4Noise. A track record is not evidence about this conversion. It nudges you to trust the project and skip verification.
- 5Keyword. An independence trigger. Performing a control the auditor must then assess creates a self-review threat, whatever the deadline.
- 6Noise. Flattery that makes helping sound efficient. Knowing the system does not change who should own the reconciliation.
- 7Qualifier. Sequence. Before reporting, escalating or recommending a delay, the auditor confirms whether the condition actually exists.
- ARun the reconciliation scripts and document that they were run at the project manager's requestOutThe auditor would perform a control and then assess its result, which impairs independence. Documenting the request records the problem; it does not remove it.
- BRecommend that the steering committee postpone go-live until the reconciliation is signed offOutA possible later recommendation, but premature as a first step: the gap may be only a missing signature. Whether to delay go-live is management's decision, made on confirmed findings.
- CReport the missing reconciliation to the audit committee as a high-risk findingOutEscalates before the facts are confirmed and before project management can respond. An unverified high-risk finding damages the audit's credibility if the work was in fact done.
- DDetermine whether the reconciliation was performed and obtain its resultsAnswerConfirms the condition before anything else. If the work was done but not signed, the issue is documentation; if it was not done, the auditor has evidence to take to management before go-live.
The lesson: On FIRST questions the earliest correct step is usually to confirm the condition; options that fix, escalate or recommend come later or belong to someone else.
Now do it at exam speed
The CISA app has 5,300+ exam-style questions with an explanation for every option. Read each stem with the routine above and check whether your elimination matches the explanation.
App StoreGoogle PlayFree CISA practice testKeyword decoder: what the stem is telling you
These phrases recur in CISA stems. Each one narrows the answer before you read the options.
| When the stem says | It points to | Usually the wrong pick |
|---|---|---|
| Auditor role | ||
the IS auditor should recommend | A control improvement that management owns and implements | The auditor configuring, patching or rewriting the control personally |
management has accepted the risk | Check the acceptance was made at the right level and documented, then report it | Insisting on remediation anyway, or quietly dropping the finding |
asked the auditor to help design controls | Advice is acceptable; owning or approving the design is not | Signing off the design, then auditing the same system later |
the auditor previously worked on the system | An independence threat to disclose, then reassign or document mitigation | Carrying on because the auditor knows the system best |
the auditee disagrees with the finding | Recheck the evidence, discuss it, and include management's response in the report | Deleting the finding to keep the peace, or escalating straight to the board |
| Evidence and testing | ||
BEST evidence | Independent, system-generated or auditor-performed evidence over inquiry and assurances | A signed memo or verbal assurance from the process owner |
operating effectiveness | Proof the control ran throughout the period: sampling, inspection, reperformance | Reviewing the policy, or a single walkthrough |
adequacy of control design | Whether the control, run as described, would address the stated risk | Testing a full year of transactions before the design is understood |
confirmation from the third party | Evidence sent to and received directly by the auditor | Accepting the auditee's copy of the third party's letter |
estimate the rate of deviation from a control | Attribute sampling for yes/no compliance testing | Variable sampling, which estimates amounts or quantities |
the full population is held electronically | Data analytics or CAATs testing every record | A small manual judgmental sample when the whole data set is available |
independent assurance report on the service provider | Check scope, period covered, exceptions and the user controls it assumes | Treating the report as cover for every control the organization relies on |
| Risk and priority | ||
GREATEST concern | The condition with the largest impact on business objectives, often the root cause | The most technical-sounding defect, or an easy housekeeping gap |
audit resources are limited | A risk-based plan: highest-risk, business-critical areas first | Equal rotation through all areas, or repeating last year's scope |
a compensating control exists | Test whether it reduces the same risk before rating the gap | Reporting the missing primary control without assessing the compensation |
the same person can change and deploy code | A segregation of duties conflict; look for independent review of changes | Accepting it as normal because the team is small |
PRIMARY purpose | The reason the control or activity exists | A true but secondary benefit of the same control |
| Sequence and reporting | ||
What should the auditor do FIRST? | Understand, confirm or assess risk before acting or reporting | Escalating or recommending a fix before the facts are confirmed |
indicators of possible fraud | Report through the channel the audit charter sets, above the implicated level | Confronting the suspect or running a forensic investigation alone |
management states the issue is fixed | Follow-up: verify the corrective action with evidence before closing | Closing the finding on management's confirmation alone |
before the report is issued | Discuss findings with the auditee to validate facts and capture responses | Softening a finding's substance because the auditee objects |
The qualifier words
The qualifier decides between options that all work. On the CISA these words carry a specific meaning:
The condition with the largest potential impact on business objectives. Often the root cause the other findings depend on, not the most visible defect.
Which of the following should be of GREATEST concern to an IS auditor reviewing a vendor's remote access to production?
The most reliable proof available: external over internal, system-generated or reperformed over inquiry, objective over opinion, and covering the period under review.
Which of the following provides the BEST evidence that backup restorations succeed?
The earliest correct step in sequence. Usually understanding, confirming or assessing risk before reporting, recommending or acting.
An IS auditor notes unapproved changes in production. What should the auditor do FIRST?
The main reason a control, document or activity exists. Several options may be real benefits; only one is the purpose.
The PRIMARY objective of a post-implementation review is to determine whether...
Rank the defensible options for this auditor in this situation. Remove role violations first, then take the option with the widest risk coverage.
Which of the following is the MOST appropriate recommendation for the segregation of duties conflict identified?
ISACA's CISA item-writing guide tells writers to avoid negatively phrased stems, so expect positive qualifiers. If one appears, restate it in positive form before eliminating.
Expect 'Which of the following is the BEST...' rather than 'Which of the following is NOT...'
How the wrong answers are built
Distractors are not random. Most wrong options on the CISA fall into one of these patterns:
The auditor fixes it
The tellThe option has the auditor configuring, writing, running, approving or owning a control.
Why it temptsIt solves the problem fast, and most candidates come from IT roles where fixing things is the job.
Management's word as evidence
The tellThe evidence is a memo, interview answer, internal confirmation or self-assessment from the auditee.
Why it temptsIt comes from someone senior, sounds conclusive and is the easiest evidence to get.
Verdict before evidence
The tellReport, escalate, recommend a halt or give an opinion while the stem has not confirmed the facts.
Why it temptsThe stem plants urgency or an alarming detail, so decisive action feels responsible.
Design passed off as operation
The tellReviewing a policy, procedure or one walkthrough when the stem asks whether the control worked over a period.
Why it temptsDocuments are concrete and quick to inspect, so the option sounds thorough.
True but downstream
The tellA real weakness that follows from a bigger one, or a housekeeping gap that is quick to fix.
Why it temptsIt is a genuine finding, so choosing it never feels wrong until you compare impact.
Time budget by question type
| Question type | Budget | Tactic |
|---|---|---|
| Short direct question, one or two sentences | ~1 min | Name the role and the qualifier, predict the answer, then eliminate. Bank the spare seconds for longer scenario items. |
| Scenario stem with several facts or findings | ~2 min | Mark constraints and strike noise on the first read. Rank the survivors by business impact, not by how technical they sound. |
| Scenario set: one description, two or more questions | ~2 min per question | Read the description once, carefully. Answer each question on its own qualifier; an earlier answer does not decide the next one. |
| Flagged items at the end | 20-25 min reserve | Answer every item before flagging, since wrong answers carry no penalty. Revisit only items where you can name what was uncertain. |
How to practise reading, not just content
Knowing the material is half of it. These drills train the reading:
Role strike
On each practice question, before weighing content, cross out every option where the auditor implements, approves or decides for management. Log any time the key was an option you struck, then reread that stem to see who was actually acting.
Qualifier swap
Take one scenario and answer it three times with the qualifier changed to GREATEST concern, BEST evidence and FIRST. Write one line on why the key moves each time. This trains you to answer the ask, not the topic.
Evidence ladder
Pick ten controls from the exam content outline. For each, list four kinds of evidence and order them from weakest to strongest: inquiry, auditee-prepared document, inspection of system records, reperformance or direct third-party confirmation. Check your order against the review manual's evidence criteria.
The CISA at a glance
| Questions | 150 multiple-choice questions |
| Time | 4 hours (240 minutes) |
| Passing score | Scaled 450 on a 200-800 scale |
| Question types | Multiple choice: four options, one best answer; some scenarios carry two or more questions |
| Going back / flagging | Flag items and return to them before ending the exam; no penalty for wrong answers |
| Fee | US$575 ISACA member / US$760 non-member |
| Delivery | PSI test center or online remote proctoring |
Practise the reading, not just the facts
Work CISA questions by domain on the app or try the free practice test. After each miss, find the phrase in the stem you read past.
App StoreGoogle PlayFree CISA practice testFAQ
Are these real CISA exam questions?
No. The three scenarios on this page are original, written for this guide against ISACA's published CISA exam content outline, effective August 2024. They are not taken from exam dumps, prep vendors, ISACA's Questions, Answers and Explanations database or ISACA's sample items, and live exam content is confidential. Use them to practice reading stems, not to memorize answers.
How do CISA questions differ from CISM questions?
CISA puts you in the IS auditor's seat: you evaluate controls, gather evidence, report and recommend, and you stay independent of what you audit. CISM puts you in the security manager's seat, where designing and running the security program and aligning it with business goals is the job. An action that suits a security manager, such as choosing and deploying a control, is usually wrong on CISA because the auditor would then own it. ISACA updates the CISM outline on 3 November 2026.
How many questions are on the CISA exam and how is it scored?
The exam has 150 multiple-choice questions, each with four options and one best answer, and you have 4 hours. ISACA reports a scaled score from 200 to 800, and 450 or higher passes. Some items are unscored pretest questions you cannot identify, and there is no penalty for wrong answers, so answer everything. Domain results are informational only; the pass decision rests on your total score.
Does the CISA exam use NOT or LEAST questions?
ISACA's CISA Item Development Guide, updated in April 2022, tells item writers that negatively phrased items, those asking which option does NOT apply or is LEAST preferred, are returned for revision because they test poorly. So expect positive qualifiers such as BEST, MOST, FIRST, PRIMARY and GREATEST. If a negative stem does appear, restate it in positive form before you start eliminating.
Is a new CISA exam coming?
The current CISA exam content outline took effect on 1 August 2024, with five domains weighted 18, 18, 12, 26 and 26 percent. As of October 2026, ISACA's CISA pages announce no replacement outline. The outline change scheduled for 3 November 2026 applies to CISM, not CISA. Separately, CPE rules for certified holders change on 1 January 2027; that does not alter the exam itself.
Sources
Figures on this page come from ISACA and the other primary sources below:
- ISACA - CISA Certification
- ISACA - CISA Exam Content Outline
- ISACA - Exam Candidate Guides (Certification Exam Candidate Guide, Version 1.26)
- ISACA - CISA Item Development Guide (updated April 2022)
- ISACA press release - CISA exam updated, available 1 August 2024
- ISACA Now - A Strategy for Tackling ISACA Certification Examinations
- ISACA - CPE Policy Changes for 2027
Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with ISACA before you book.