Last updated:
CISA preparation guide
Why isn't a documented plan enough evidence in a CISA question?
In a CISA question, a policy, procedure or plan shows what the organisation intends to do, not what it does. The trap is the option that accepts the document as proof, because it looks thorough and is often the most recent artefact in the scenario. The stronger option looks for evidence that the control operated: a tested recovery, a sample of approved changes, an access review with its outcomes, or the auditor’s own observation.
The trap appears in every domain. It is commonest in Domain 4 (continuity and recovery plans) and Domain 5 (security policies), where a newly approved document is easy to mistake for a working control.
This is independent CertArc teaching material.
Start CISA baselineDocument vs evidence it operates
| The scenario shows … | It proves … | Evidence that the control operates |
|---|---|---|
| A disaster recovery plan approved last month | The plan exists and is approved | The last recovery test, its results and the fixes |
| A change management policy | The rule exists | A sample of production changes traced to approvals |
| An access review procedure | Reviews are expected | The completed review, with the access removed as a result |
| A backup schedule | Backups are planned | Restore test results |
| A signed security awareness policy | Staff were told | Phishing-simulation or incident trends |
| A vendor’s contract with security clauses | The vendor promised | The vendor’s assurance report or the right-to-audit results |
Original teaching example
Management shows the auditor a new incident response plan, approved by the board two weeks ago, and asks for the finding on incident readiness to be closed.
The plan answers the design question: is there a sensible process? It does not answer the operating question: will people follow it under pressure? Until there is a tabletop exercise, a real incident handled under the plan, or some other test, the auditor can say the design gap is closed but not that readiness is proven. The finding moves; it does not close.
Why the trap works
Documents are concrete, recent and approved, and approval sounds like assurance. Approval shows that the right people agreed the design. Operating evidence shows that the design is followed. A question that asks for the BEST evidence, or what the auditor should do FIRST before relying on a control, is asking for the second.
Design and operating effectiveness
Auditors test controls twice. A design test asks whether the control, as written, would address the risk. An operating test asks whether it worked over the period. A document can pass the first test and still fail the second. When a question gives you a document and asks whether to rely on the control, the missing step is the operating test.
When the document is the right answer
Sometimes the gap really is the document. If there is no recovery plan at all, or the plan was never approved, the auditor’s finding is about the missing design, and asking for test results would be premature. Read the question for what already exists before you choose.
Frequently asked questions
Is reviewing the policy ever the FIRST step?
Yes, when the auditor needs to understand the control before testing it. Understanding comes before testing, but it is not evidence that the control works.
Does management’s sign-off make a document stronger evidence?
It shows the design was approved. It does not show the control operated.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Checked 27 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
