CISA

CISA Exam Details

Domain Weight Breakdown

Experience Substitutions & Waivers

• A maximum of 3 years may be substituted: 1 year of IS experience or 1 year of non-IS auditing can replace 1 year of CISA experience
• A 2-year or 4-year degree from an accredited university can substitute for 1 or 2 years respectively
• A master's degree in information security or IT can substitute for 1 year
• University instructor with 2 years of teaching in a related field can substitute for 1 year

Tip: CISA is recognized worldwide as the gold standard for IS audit professionals. The exam tests both knowledge and the ability to apply audit concepts in real-world scenarios. Focus on understanding the “why” behind audit practices, not just memorizing procedures.

Audit Standards, Guidelines, and Procedures

ISACA’s IT Audit Framework (ITAF) organizes standards into three categories: General Standards (independence, ethics, competence), Performance Standards (planning, fieldwork, supervision), and Reporting Standards (report content, distribution).

Audit Planning Process

• Audit Charter: Formal document approved by the board or audit committee granting authority, responsibility, and scope of the audit function
• Risk Assessment: Identify and rank risks to prioritize audit coverage. Use a risk-based approach to allocate limited audit resources to the highest-risk areas
• Audit Universe: Comprehensive inventory of all auditable entities, processes, and systems across the organization
• Audit Plan: Annual plan based on risk assessment results. Reviewed and approved by audit committee. Includes scope, objectives, timing, and resource allocation
• Engagement Letter: Formalizes the scope, objectives, and timeline for individual audit engagements

Tip: Risk-based auditing is the cornerstone of modern IS audit. The audit plan should always be driven by the risk assessment, ensuring the highest-risk areas receive priority attention.

Types of Audit Tests

Control testing sequence: First perform compliance tests to verify the control exists and works. If the control is found to be reliable, substantive testing can be reduced. If unreliable, increase substantive testing to detect potential errors or irregularities.

Sampling Methods

Evidence and Documentation

• Sufficient evidence: Enough evidence to support the auditor's findings and conclusions
• Reliable evidence: Most reliable: obtained directly by the auditor (observation, recalculation). Least reliable: oral representations from auditee
• Relevant evidence: Evidence that is pertinent to the audit objective being tested
• Working papers: Must be retained per organizational policy and regulatory requirements (typically 5-7 years). They document the audit process, evidence, findings, and conclusions

Tip: Evidence reliability hierarchy (most to least reliable): auditor-generated evidence > third-party evidence > auditee-generated evidence > oral evidence.

Audit Reporting and Follow-Up

• Finding components: Condition (what exists), Criteria (what should exist), Cause (why the gap exists), Effect (risk or impact of the gap), Recommendation (corrective action)
• Exit conference: Held with management before issuing the final report to discuss findings and obtain management responses
• Report distribution: Distributed to appropriate stakeholders as defined in the audit charter
• Follow-up: Auditor must monitor and track remediation of reported findings. Management is responsible for implementing corrective actions

IT Governance Frameworks

IT Governance Responsibilities

Tip: The board sets governance direction but does NOT implement it. Senior management implements. The IT steering committee is the key advisory body that ensures IT investments align with business strategy.

IT Strategy and Balanced Scorecard

The IT strategy must be aligned with and support the overall business strategy. The IT Balanced Scorecard (BSC) measures IT performance across four perspectives:

IT Policies, Procedures, and Standards

• Policy: High-level statement of management intent and direction. Approved by senior management. Mandatory compliance
• Standard: Specific mandatory requirements that support policies (e.g., minimum password length of 12 characters)
• Procedure: Step-by-step instructions for implementing standards and policies
• Guideline: Recommended best practices. Not mandatory
• Baseline: Minimum acceptable level of security configuration for a system type

IT Resource Management

• HR management: Hiring practices, background checks, mandatory vacations, separation of duties, job rotation, and termination procedures
• Outsourcing: Auditor should review the SLA, right-to-audit clause, data protection requirements, and the vendor's compliance certifications (SOC 1, SOC 2)
• IT performance monitoring: KPIs, KGIs (Key Goal Indicators), and KRIs (Key Risk Indicators) should be defined, measured, and reported regularly
• Quality assurance: QA processes ensure that IT deliverables meet defined quality standards (ISO 9001)

Tip: Mandatory vacations and job rotation are detective controls that help identify fraud. If an employee refuses to take vacation, it may indicate they are concealing unauthorized activities.

SDLC (Systems Development Life Cycle)

Development Methodologies

Testing Types

Change Management Controls

• Change request: All changes must be formally requested, documented, and approved before implementation
• Impact analysis: Assess the effect of changes on existing systems, interfaces, and processes
• Authorization: Changes approved by the Change Advisory Board (CAB) or appropriate authority
• Testing: All changes must be tested in a non-production environment before deployment
• Rollback plan: A documented plan to revert changes if implementation fails
• Separation of duties: Developers should NOT have access to production. A different team should migrate code to production
• Emergency changes: Allowed with post-implementation review and retroactive approval, but must be documented

Tip: The most critical change management control from an audit perspective is separation of environments (development, testing, production) and ensuring developers cannot directly modify production systems.

Application Controls

IT Service Management

BCP/DRP Key Concepts

Recovery Site Types

DRP Testing Types

Tip: The full interruption test is the most realistic but carries the highest risk. Most organizations use parallel tests as the best balance of reliability and safety. DRP should be tested at least annually and after major changes.

Backup Strategies

Backup media should be stored offsite. The Grandfather-Father-Son (GFS) rotation scheme uses daily (son), weekly (father), and monthly (grandfather) backup cycles for efficient retention management.

Preventive vs Detective vs Corrective Controls

Tip: On the CISA exam, the BEST control answer is almost always a preventive control. Preventive controls are preferred because they stop problems before they occur, reducing impact and cost.

Compliance Testing vs Substantive Testing

BCP vs DRP

Incident Management vs Problem Management

Symmetric vs Asymmetric Encryption

IDS vs IPS

Tip: CISA commonly tests the difference between governance (direction-setting by the board) and management (day-to-day execution by executives). Remember: the board governs, management manages, and the IS auditor provides independent assurance over both.