How should an auditor test an automated daily data flow for completeness?

CISA By islever Editorial Last updated Sep 8, 2026

Short answer

D Perform data reconciliation between the two systems for a sample of 25 days.

Question

Which of the following is the MOST appropriate testing approach when auditing a daily data flow between two systems via an automated interface to confirm that it is complete and accurate?

Conduct code review for both systems and inspect design documentation.
Inspect interface configurations and an example output of the systems.
Confirm that the encryption standard applied to the interface is in line with best practice.
Perform data reconciliation between the two systems for a sample of 25 days. Correct Answer

Key Takeaways

The exam distinguishes substantive testing of actual data transfers from configuration, output examples, or security control reviews; data reconciliation is the only option that verifies daily completeness and accuracy.

Data reconciliation is the core audit test for confirming completeness and accuracy of an automated daily data flow. This page explains why a 25-day reconciliation sample is the correct CISA exam answer.

Common mistake: Choosing B because inspecting interface configurations and an example output seems direct, but an example output cannot prove that all daily records were transferred completely and accurately over time.

Expert Analysis

Why the Answer Is Correct

Option D is the correct answer because data reconciliation compares the records in the source system with the records in the receiving system for a sample of 25 days. This directly tests whether the daily automated data flow is complete and accurate over a meaningful period. For a daily flow, a 25-day sample gives the auditor representative evidence that the interface is working correctly on multiple days, not just on one occasion.

Why the Other Options Are Wrong

Option A, conducting code review and inspecting design documentation, is a review of how both systems were built rather than a substantive test of whether the daily data actually gets transferred accurately. Option B, inspecting interface configurations and an example output, confirms the interface is configured and that a single sample output looks plausible, but it does not verify that every day's complete data set is transmitted. Option C, confirming encryption standards, addresses confidentiality and security, but the question asks about completeness and accuracy, not protection of the data in transit.

Community Comment Notes

Swallows explained that data reconciliation compares data from one system with data from another system to ensure consistency and accuracy. marc4354345 reinforced the idea that to confirm data flow is complete, auditors must examine full data, not just an "Example output would not be enough." MJORGER argued for option B, but configuration review plus one example output still fails to demonstrate that the daily flow is complete over a representative sample of many business days.

Official Reference

https://www.isaca.org/credentialing/cisa

This link opens the official vendor documentation in a new tab.

Exam Strategy

For CISA auditor-response questions, ask yourself which option provides substantive evidence about the actual processing risk named in the question. When the risk is data completeness and accuracy, choose a test that compares real data across systems over multiple days, not configuration review or security controls.

Frequently Asked Questions

Why is inspecting interface configurations and one example output not sufficient for this audit?

Because it only proves the interface is set up and one output looks correct; it does not verify that complete, accurate data is exchanged every day over time.

Why is a 25-day sample better than code review when testing a daily data flow?

Data reconciliation over 25 sample days tests actual daily transfer outcomes, while code review only checks design and build and cannot detect operational data loss.

More CISA FAQ →

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

Swallows 👍 1 Answered D

Data reconciliation involves comparing data from one system with data from another system to ensure consistency and accuracy. By performing data reconciliation for a sample of 25 days, auditors can verify the completeness and accuracy of the daily data flow between the two systems over a representative period. This approach provides a comprehensive assessment of the automated interface's performance and allows auditors to identify any discrepancies or anomalies that may indicate issues with data integrity or completeness. Additionally, it offers insights into the reliability of the automated data transfer process and helps ensure that the systems are functioning as intended.
MJORGER 👍 1

I think that option B (Inspect interface configurations and an example output of the systems.) is the correct answer. It directly addresses the completeness and accuracy of the data flow between the systems.
marc4354345 👍 1 Answered D

Question asks to confirm that data flow is "complete". This means full data must be examined. "Example output" would not be enough.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide