Certified Information Systems Auditor (CISA) Governance and Management of IT Syllabus

A security policy states passwords must be 'strong.' A document specifying minimum 12 characters with complexity is which type of document?

A standard (it provides the mandatory, specific, measurable requirement that supports the policy).

What is the purpose of an IT steering committee?

A management-level committee (cross-functional) that oversees major IT initiatives, prioritizes and approves IT investments/projects, allocates resources, and ensures IT operations align with business needs.

What is the difference between an IT strategy committee and an IT steering committee?

The IT strategy committee operates at board level advising on strategic direction and governance; the IT steering committee operates at executive/management level overseeing implementation, project prioritization, and resource allocation.

What are 'decision rights' in IT governance?

The formal assignment of who has authority and accountability to make and provide input on specific IT decisions (e.g., IT principles, architecture, infrastructure, business application needs, and investment/prioritization).

What is enterprise architecture (EA)?

A holistic blueprint and discipline describing the structure and integration of an organization's business processes, information, applications, and technology infrastructure, used to guide IT toward the target (future) state in alignment with strategy.

What is the role of enterprise architecture management in governance?

It ensures IT investments and solutions conform to defined standards and the target architecture, reducing complexity/redundancy, enabling interoperability, and aligning technology decisions with business strategy.

In IT organizational structure, why should the IT function ideally report to a high level (e.g., CEO or board) rather than to a single user department?

To maintain independence and ensure IT serves the whole enterprise objectively, avoiding bias toward one department and preserving appropriate oversight and alignment with corporate strategy.

What is segregation of duties (SoD)?

A control that divides responsibilities among different people so no single individual can both perpetrate and conceal an error or fraud, reducing risk by requiring collusion to bypass controls.

Give a classic example of incompatible IT duties that should be segregated.

Application development/programming should be separated from production operations and from security administration; e.g., a developer should not have access to modify code directly in production. Also, custody of assets, authorization, record-keeping, and reconciliation should be split.

When segregation of duties is not feasible (e.g., small IT shops), what is the appropriate response?

Implement compensating controls such as supervisory review, audit trails/logging, reconciliations, exception reporting, and management oversight to detect inappropriate activity.

Name three key human resource controls relevant to IT security.

Background/screening checks before hiring; mandatory vacations and job rotation (to detect/deter fraud); and timely revocation of access upon termination or transfer, plus security awareness training and NDAs.

Why are mandatory vacations and job rotation considered controls?

They help detect and deter fraud or irregularities because another person must perform the absent employee's duties, exposing concealed errors or fraudulent schemes that depend on continuous control by one person.

What are the main IT sourcing strategy options?

Insourcing (in-house delivery), outsourcing (third party delivers), and hybrid; plus location models: onshore (same country), nearshore (nearby country), and offshore (distant country).

In outsourcing, what can and cannot be transferred to the service provider?

Responsibility for performing the function/operations can be transferred, but accountability for the outsourced activity and its risks remains with the outsourcing organization (the board/management retains ultimate accountability).

What is a key governance concern when outsourcing IT functions?

Maintaining oversight and control—through SLAs, right-to-audit clauses, monitoring, and clear contractual responsibilities—since accountability and compliance obligations remain with the organization despite the function being outsourced.

What are the standard phases of the risk management lifecycle/process?

1) Risk identification; 2) Risk assessment/analysis (likelihood x impact); 3) Risk response/treatment; 4) Risk monitoring and reporting (and review). It is iterative and continuous.

What is the difference between qualitative and quantitative risk assessment?

Qualitative uses descriptive scales (high/medium/low) for likelihood and impact; quantitative assigns numeric/monetary values (e.g., ALE = SLE x ARO) to estimate loss expectancy.

State the formulas for SLE and ALE in quantitative risk analysis.

SLE (Single Loss Expectancy) = Asset Value x Exposure Factor. ALE (Annualized Loss Expectancy) = SLE x ARO (Annualized Rate of Occurrence).

Define risk appetite, risk tolerance, and risk capacity.

Risk appetite = the broad amount of risk an enterprise is willing to accept in pursuit of objectives; risk tolerance = the acceptable deviation/variance around appetite for a specific objective; risk capacity = the maximum (objective) amount of risk the enterprise can actually absorb before threatening viability.

What are the four risk treatment (response) options?

Risk mitigation/reduction (apply controls), risk avoidance (eliminate the activity), risk transfer/sharing (e.g., insurance, outsourcing), and risk acceptance (retain within tolerance).

What is residual risk?

The level of risk that remains after controls/risk treatments have been applied; it should be reduced to within the organization's risk appetite/tolerance, and any residual risk must be formally accepted by management.

What is a risk register?

A documented repository that records identified risks along with their description, owner, likelihood, impact, risk rating, treatment/response, controls, status, and residual risk—used to track and manage risks over time.

What is a Key Risk Indicator (KRI) and how does it differ from a KPI?

A KRI is a metric that signals increasing risk exposure (a leading/early-warning indicator of potential risk events); a KPI measures performance/achievement of objectives. KRIs warn of rising risk; KPIs measure how well goals are met.

What characteristics make an effective KRI?

It should be a leading indicator (predictive/early warning), measurable/quantifiable, linked to specific risk and objectives, have defined thresholds, and be reliable and repeatable.

What are the key steps in vendor selection and due diligence?

Define requirements, issue RFP/RFI, evaluate proposals against criteria, perform due diligence (financial stability, reputation, references, security/compliance posture, capabilities), select, and negotiate the contract.

What is a Service Level Agreement (SLA)?

A formal, measurable agreement between a service provider and customer defining the expected level of service—including metrics (e.g., availability, response/resolution times), responsibilities, reporting, and penalties/remedies for non-performance.

What is the difference between an SLA and an OLA?

An SLA is between the service provider and the (external) customer; an OLA (Operational Level Agreement) is an internal agreement between supporting teams within the provider organization that underpins the SLA.

What contractual clauses are important for governing an outsourcing/vendor relationship?

Right-to-audit, SLAs/penalties, confidentiality/data protection, compliance and security requirements, escrow (for source code), liability and indemnification, business continuity/DR obligations, and termination/exit (transition) provisions.

Why is ongoing monitoring of service providers important after contract signing?

To verify the provider continues to meet SLA commitments, security and compliance obligations, and to detect performance degradation or new risks—monitoring via SLA reports, independent assurance reports (e.g., SOC 2), audits, and periodic reviews.

What is a SOC 2 report and why is it relevant to vendor governance?

A SOC 2 report is an independent assurance report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy (Trust Services Criteria); it provides assurance over an outsourced provider's control environment.

What is the key governance principle of the shared responsibility model in cloud computing?

Security and compliance responsibilities are split between the cloud provider and customer based on service model—e.g., in IaaS the customer manages more (OS, apps, data), in SaaS the provider manages more—but the customer always retains accountability for its data and compliance.

Name the three primary cloud service models and what the customer manages in each.

IaaS (customer manages OS, runtime, applications, and data on provider's infrastructure); PaaS (customer manages applications and data on provider's platform); SaaS (customer manages mainly data/configuration/access while provider manages the application and below).

What is a key governance concern with cloud/managed services regarding vendor lock-in?

Difficulty and cost of migrating away from a provider due to proprietary technologies or data formats; mitigated through portability/interoperability requirements, clear exit/transition clauses, and data return/deletion provisions in the contract.

What is compliance management in an IT context?

The ongoing process of identifying applicable legal, regulatory, and contractual requirements, implementing controls to meet them, and monitoring/reporting adherence to avoid penalties, legal liability, and reputational damage.

How should an organization keep track of applicable laws and regulations affecting IT?

Maintain a compliance register/inventory of applicable legal, regulatory, and contractual requirements, assign ownership, map them to controls, and monitor for changes—ensuring continuous compliance and accountability.

What is the purpose of a privacy program within IT governance?

To govern the collection, use, storage, sharing, and protection of personal data in line with privacy laws and principles (e.g., data minimization, purpose limitation, consent, individual rights), assigning accountability (often a DPO) and managing privacy risk.

What is the difference between a data controller and a data processor under privacy law (e.g., GDPR)?

The data controller determines the purposes and means of processing personal data (and bears primary accountability); the data processor processes data on behalf of and under the instructions of the controller.

What is 'privacy by design'?

A principle requiring that privacy and data protection be embedded proactively into the design and architecture of systems, processes, and products from the outset—rather than added afterward—as a default setting.

What is a maturity model in the context of IT process capability?

A framework that rates the maturity/capability of processes along defined levels (e.g., from ad hoc to optimized), enabling assessment of current state, benchmarking, and a roadmap for improvement.

List the levels of the CMM/CMMI-style maturity scale (0-5) used to assess process maturity.

0 = Non-existent/Incomplete; 1 = Initial/Ad hoc; 2 = Managed/Repeatable; 3 = Defined; 4 = Quantitatively Managed/Measurable; 5 = Optimizing (continuous improvement).

In COBIT 2019, what scale is used to assess process capability and how does it differ from older maturity models?

COBIT 2019 uses a process capability level scale of 0-5 (based on ISO/IEC 33000), rating each individual process's capability, whereas older maturity models assessed overall maturity; COBIT 2019 also adds maturity levels at the focus-area level.

What is the value to an IS auditor of using a maturity/capability assessment?

It provides an objective baseline of current process capability, helps identify gaps against target levels, supports benchmarking, and prioritizes improvement recommendations.

What is a Quality Management System (QMS) for IT?

A formalized system documenting processes, policies, and responsibilities for achieving quality objectives and continually improving IT products/services to meet customer and regulatory requirements (e.g., aligned to ISO 9001).

What is the Plan-Do-Check-Act (PDCA) cycle and how does it relate to quality management?

PDCA is the continuous improvement cycle underpinning QMS: Plan (set objectives/processes), Do (implement), Check (measure/monitor results), Act (correct and improve)—driving ongoing quality enhancement.

What is the difference between quality assurance (QA) and quality control (QC)?

QA is process-oriented and proactive—ensuring processes are defined to prevent defects; QC is product-oriented and reactive—inspecting/testing the output to detect defects before delivery.

What is the role of the CIO versus the CISO in IT governance?

The CIO is responsible for the overall IT strategy, delivery, and operations enabling the business; the CISO is responsible for the information security strategy, risk, and program—ideally reporting independently of the CIO to avoid conflicts of interest.

Why should the information security function ideally not report directly to the CIO?

To preserve independence and avoid a conflict of interest, since the CIO's operational/delivery priorities (cost, speed) may conflict with security objectives; independent reporting (e.g., to the CEO, CRO, or board) strengthens objectivity.

What is a RACI chart and how is it used in IT governance?

A responsibility assignment matrix mapping activities/decisions to roles as Responsible, Accountable, Consulted, and Informed—clarifying who does the work, who is ultimately answerable, and who provides input or is kept informed. Each task has exactly one 'Accountable.'

What is the relationship between enterprise goals, alignment goals, and governance/management objectives in COBIT 2019's goals cascade?

The goals cascade translates stakeholder needs/drivers into enterprise goals, which cascade to alignment goals (IT-related goals), which in turn drive the selection and prioritization of governance and management objectives.