FIRST, BEST, MOST: the small words that decide your CISA score

Read this question stem twice: "What should the IS auditor do FIRST?"

Now read this one: "What is the MOST important control?"

They can sit on top of the same scenario and have different right answers. The qualifier is not decoration. It is the question.

FIRST

When the exam asks what to do first, it is testing sequence. The answer is almost always the step that comes before action: understanding the process, assessing risk, planning, or gathering evidence. Reporting to management, recommending a fix or testing a control are rarely first.

Ask yourself: which phase of the audit is this? Plan, assess risk, execute, report, follow up. Identify the phase, then choose the step that belongs to it.

BEST

Several options may work. "Best" asks which one a senior, independent auditor would recommend. Prefer the answer that:

• addresses the root cause rather than the symptom
• follows a defined, authorised process rather than a quick fix
• gives direct evidence rather than someone's word for it

Watching a restore test is better evidence that backups work than reading backup logs. Both are reasonable; only one is best.

MOST and PRIMARY

These ask about importance or purpose. They reward thinking about the business, not the technology. The most important control is usually the one that prevents the biggest risk to the organisation's objectives. The primary purpose of something is the reason it exists, not a side benefit.

A habit worth building

Every time you practise, underline the qualifier before you read the options. Then say the question back to yourself in plain words: "They want the first step," "They want the strongest evidence." You'll be surprised how many "I knew this but got it wrong" moments disappear.