Certified Information Systems Auditor (CISA) Information Systems Auditing Process Syllabus

Information Systems Auditing Process syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Information Systems Auditing Process in Certified Information Systems Auditor (CISA), not a summary of it.

1. 1

   Audit Standards, Guidelines, and Codes of Ethics

   4 topics

   • ISACA IS Audit and Assurance Standards
     • Mandatory standards vs. discretionary guidelines
     • General, performance, and reporting standard categories
     • ITAF (Information Technology Assurance Framework) structure
   • ISACA Code of Professional Ethics
     • Due professional care and confidentiality
     • Reporting non-compliance and conflicts of interest
   • Auditor independence and objectivity
     • Organizational vs. professional independence
     • Impairments to independence and safeguards
   • Other professional frameworks and standards
     • COBIT, IIA standards, and ISO/IEC 27001 references
2. 2

   Types of Audits and Assessments

   5 topics

   • Internal, external, and third-party audits
   • Compliance, operational, and financial audits
     • SOX, PCI DSS, and HIPAA-driven engagements
   • Integrated and continuous auditing approaches
   • Forensic audits and special-purpose reviews
   • Attestation engagements (SOC 1, SOC 2, SOC 3)
3. 3

   Risk-Based Audit Planning

   5 topics

   • Audit universe and annual audit plan development
   • Risk assessment to prioritize audit areas
     • Inherent, control, and residual risk
     • Audit risk model (inherent x control x detection)
   • Defining audit objectives, scope, and criteria
   • Resource allocation and engagement budgeting
   • Materiality in an IS audit context
4. 4

   Audit Execution and Evidence

   5 topics

   • Audit methodology and project management
     • Fieldwork phases and milestone tracking
   • Gathering and evaluating audit evidence
     • Sufficiency, reliability, and relevance of evidence
     • Evidence sources: observation, inquiry, inspection, reperformance
   • Sampling techniques
     • Statistical vs. non-statistical sampling
     • Attribute, variable, and stop-or-go sampling
   • Computer-assisted audit techniques (CAATs)
     • Test data, integrated test facility, parallel simulation
     • Generalized audit software and data analytics
   • Working papers and documentation standards
5. 5

   Reporting, Communication, and Follow-Up

   5 topics

   • Structuring audit findings and observations
     • Condition, criteria, cause, effect, recommendation
   • Drafting and issuing the audit report
   • Communicating results to stakeholders and governance
   • Management responses and remediation tracking
   • Quality assurance and improvement of the audit function

Information Systems Auditing Process flashcards for Certified Information Systems Auditor (CISA)

18 of 50 cards from the Information Systems Auditing Process deck — real questions with worked answers.

1. What is the purpose of the ISACA IS Audit and Assurance Standards?

   They are mandatory requirements that define the minimum level of acceptable performance for IS audit and assurance professionals, ensuring quality, consistency, and credibility. Compliance is required of all ISACA members and CISA holders.

2. In the ISACA IS audit pronouncement hierarchy, how do Standards, Guidelines, and Tools/Techniques differ in authority?

   Standards are mandatory (must comply); Guidelines provide guidance on applying standards and are recommended (the auditor must consider them); Tools and Techniques provide examples of processes and are optional/informational.

3. What are the three categories of ISACA IS Audit and Assurance Standards?

   (1) General standards (guiding principles: ethics, independence, objectivity, due care, competence), (2) Performance standards (conducting the engagement: planning, evidence, supervision), and (3) Reporting standards (types of reports and communication of results).

4. Under the ISACA Code of Professional Ethics, what is an auditor's duty regarding confidential information obtained during an engagement?

   To maintain the privacy and confidentiality of information obtained in the course of duties unless disclosure is required by legal authority; such information must not be used for personal benefit or released to inappropriate parties.

5. List the core duties an IS auditor commits to under the ISACA Code of Professional Ethics.

   Support implementation of and compliance with standards/procedures; serve stakeholders with diligence, due care and competence; maintain confidentiality; perform duties objectively and with independence; maintain competency; inform appropriate parties of results; and support professional education of stakeholders.

6. Distinguish independence of mind from independence in appearance for an IS auditor.

   Independence of mind (in fact) is the actual state of mind allowing an unbiased opinion. Independence in appearance is the avoidance of facts/circumstances so significant that a reasonable third party would conclude objectivity was impaired. Both are required.

7. What two dimensions make up auditor independence, and what does each cover?

   Professional/organizational independence (the audit function's placement and reporting line, ideally to the audit committee/board) and personal independence (freedom from personal relationships, financial interests, or prior involvement that could bias the auditor).

8. If an IS auditor previously designed or implemented the system now being audited, what independence concern arises and how is it addressed?

   A self-review threat to objectivity. The auditor should not audit work they performed; the involvement must be disclosed and the audit assigned to an independent auditor, or compensating reviews put in place.

9. Name commonly referenced professional frameworks/standards an IS auditor may use besides ISACA's, and their focus.

   COBIT (IT governance and management), ITIL (IT service management), ISO/IEC 27001 (information security management), NIST frameworks (cybersecurity/controls), COSO (internal control and ERM), and PMBOK (project management).

10. What does COSO provide and what are its five internal control components?

    COSO provides an internal control framework. Its five components are: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.

11. Differentiate internal, external, and third-party audits.

    Internal audits are performed by an organization's own audit function for management/board. External audits are performed by independent outside firms (e.g., for statutory/financial purposes). Third-party audits assess a vendor/service provider's controls, often on behalf of customers.

12. Compare compliance, operational, and financial audits by objective.

    Compliance audit verifies adherence to laws, regulations, contracts or policies. Operational audit evaluates the efficiency and effectiveness of operations/processes. Financial audit verifies the accuracy, integrity, and fair presentation of financial statements/information.

13. What is an integrated audit?

    An audit that combines IS (IT) audit procedures with operational and/or financial audit procedures to evaluate the overall control environment, assessing both technology and business process controls together for a more complete view of risk.

14. Define continuous auditing and how it differs from continuous monitoring.

    Continuous auditing uses automated tools to gather audit evidence and test controls on an ongoing/near-real-time basis. Continuous monitoring is a management responsibility to oversee controls continuously; auditing is performed by the audit function, monitoring by management.

15. What is a forensic audit and what special requirement governs its evidence?

    A specialized examination to investigate fraud, financial crime, or disputes, often producing evidence for legal proceedings. It requires preserving a strict chain of custody so evidence is admissible and not altered.

16. What is the difference between a SOC 1, SOC 2, and SOC 3 report?

    SOC 1 covers controls relevant to a user entity's financial reporting (ICFR). SOC 2 covers controls related to the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). SOC 3 is a public, general-use summary of SOC 2 results without detailed test descriptions.

17. Distinguish a SOC 2 Type I report from a Type II report.

    Type I reports on the design/suitability of controls at a point in time. Type II reports on both the design and operating effectiveness of controls over a period of time (typically 6–12 months).

18. What are the five SOC 2 Trust Services Criteria categories?

    Security (the only mandatory/common criterion), Availability, Processing Integrity, Confidentiality, and Privacy.

See more Information Systems Auditing Process flashcards →

Planning Information Systems Auditing Process for Certified Information Systems Auditor (CISA)

Information Systems Auditing Process (Certified Information Systems Auditor (CISA)) FAQ