Certified Information Systems Auditor (CISA) Information Systems Auditing Process Syllabus

Why use risk assessment to prioritize audit areas rather than auditing everything equally?

Audit resources are limited; risk-based prioritization focuses effort on areas of greatest risk and potential impact, providing the most value and assurance while making efficient use of time and budget.

Differentiate audit objective, audit scope, and audit criteria.

The objective is the specific goal/purpose of the audit (what assurance is sought). The scope defines the boundaries (systems, processes, locations, time period covered). The criteria are the standards/benchmarks against which the subject matter is evaluated.

What factors are considered when allocating resources and budgeting an IS audit engagement?

Scope and complexity, required skills/competencies of auditors, estimated hours/staffing, available tools (e.g., CAATs), travel, timeline/deadlines, and contingency for unexpected issues.

Define materiality in the context of an IS audit.

Materiality is the threshold of importance; a matter is material if its omission or misstatement could influence decisions of users or indicate a significant control weakness. In IS audit it considers the criticality of systems/data, not just monetary amounts.

How does materiality assessment differ for IS audits compared with financial audits?

Financial materiality is largely quantitative (monetary). IS audit materiality is often qualitative—based on the criticality of the system, sensitivity of data, potential impact of control failures, and number of affected transactions/users—rather than dollar amounts alone.

What are the typical phases of an IS audit methodology/life cycle?

Planning (scope, objectives, risk assessment), fieldwork/execution (gathering and evaluating evidence, testing controls), reporting (documenting findings and recommendations), and follow-up (verifying remediation of issues).

What are the four general attributes (elements) every audit finding should contain?

Condition (what was found), Criteria (the standard/expectation), Cause (why the gap exists), and Effect/Consequence (the impact/risk). A recommendation is then added to address it.

Distinguish the four main types of audit evidence by reliability considerations.

Evidence is stronger when from independent/external sources rather than internal, obtained directly by the auditor rather than indirectly, in documentary/written form rather than oral, and from a strong control environment. Auditor-generated and corroborated evidence is most reliable.

What is the difference between substantive testing and compliance (controls) testing?

Compliance testing verifies that controls exist and are operating as intended. Substantive testing verifies the integrity/accuracy of actual data and transactions. Weak control test results typically lead to expanded substantive testing.

Differentiate statistical from non-statistical (judgmental) sampling.

Statistical sampling uses random selection and probability theory, allowing the auditor to quantify and project results to the population with measurable confidence. Non-statistical/judgmental sampling relies on the auditor's judgment and cannot be statistically projected.

Compare attribute sampling and variable sampling and when each is used.

Attribute sampling tests for the rate of occurrence of a characteristic (yes/no, e.g., control deviations) and is used in compliance testing. Variable sampling estimates a numeric amount or monetary value of a population and is used in substantive testing.

What is stop-or-go (sequential) sampling used for?

A sampling method that allows the auditor to stop testing as early as possible; it is used when few errors are expected, reducing sample size when the population is believed to have a low deviation rate.

What is discovery sampling and when is it appropriate?

A form of attribute sampling designed to find at least one occurrence of a critical (often fraud-related) deviation. It is used when even a single instance would be significant, such as in fraud investigations.

Define sampling risk and the two errors associated with it.

Sampling risk is the risk the sample is not representative of the population. The two errors are: alpha risk (Type I)—incorrectly concluding a control is not reliable (overreliance avoided but inefficiency), and beta risk (Type II)—incorrectly concluding a control is reliable when it is not (the more serious error).

What are Computer-Assisted Audit Techniques (CAATs) and why are they used?

Software tools and techniques (e.g., generalized audit software, data analytics, scripts) used to extract, analyze, and test large volumes of electronic data. They enable 100% testing of populations, improve efficiency, and detect anomalies/exceptions that manual testing could miss.

Give examples of CAATs an IS auditor might use.

Generalized audit software (e.g., ACL, IDEA), utility software, test data/test decks, integrated test facility (ITF), embedded audit modules (SCARF), parallel simulation, and custom scripts/queries (SQL, Python).

What is an Integrated Test Facility (ITF) as a continuous audit technique?

A technique that creates a fictitious (dummy) entity within the live production system; the auditor processes test transactions against it alongside real transactions to verify that the system processes data correctly, without affecting real records.

What is the purpose of audit working papers?

To document the audit evidence gathered, procedures performed, analyses, and conclusions reached. They support the findings/opinion, provide a record for supervision and quality review, and enable another auditor to understand the work done.

What documentation standards/attributes should working papers meet?

They should be complete, accurate, clear, relevant, dated, indexed/cross-referenced, prepared and reviewed (signed off), and securely retained per retention policy. They must demonstrate the basis for conclusions and a clear audit trail.

How should audit findings/observations be structured and prioritized in a report?

Each finding states condition, criteria, cause, effect, and a recommendation, and is rated by risk/severity (e.g., high/medium/low). Findings are typically ranked so management can prioritize remediation of the highest-risk issues first.

What key elements should the formal IS audit report contain?

Scope and objectives, period covered, applicable standards, methodology, findings/observations with risk ratings, recommendations, management's responses, the auditor's overall conclusion/opinion, and any scope limitations.

What is the difference between a finding and a recommendation in an audit report?

A finding describes the issue/control weakness identified (the condition vs. criteria, with cause and effect). A recommendation is the auditor's suggested corrective action to remediate the finding and reduce the associated risk.

To whom should IS audit results be communicated, and why include governance bodies?

Results are communicated to relevant management (process/control owners) and to governance bodies such as the audit committee/board. Reporting to governance preserves independence, ensures oversight, and ensures significant risks reach decision-makers.

What is the purpose of an audit closing/exit meeting before issuing the report?

To present and validate findings with management, confirm factual accuracy, resolve disagreements, obtain management's responses/action plans, and agree on remediation before the final report is issued.

What should a management response to an audit finding include?

Agreement or disagreement with the finding, a corrective action plan, the responsible owner, and a target completion date. If management accepts the risk instead of remediating, that risk acceptance should be formally documented.

What is remediation tracking (follow-up) and why is it part of the audit process?

It is the monitoring of management's agreed corrective actions to verify they are implemented and effective by their due dates. It ensures findings are actually resolved and that residual risk is reduced, closing the audit loop.

What is the purpose of a Quality Assurance and Improvement Program (QAIP) for an audit function?

To ensure the audit function conforms to standards and operates effectively, through ongoing internal monitoring, periodic internal self-assessments, and external assessments—driving continuous improvement of audit quality and adding credibility.

How often should an external quality assessment of the internal audit function typically occur?

At least once every five years, performed by a qualified, independent assessor/team from outside the organization, complementing ongoing and periodic internal assessments.

What is the audit risk model and its components?

Audit risk = Inherent risk × Control risk × Detection risk. Inherent risk is the susceptibility to error absent controls; control risk is the risk controls fail to prevent/detect errors; detection risk is the risk the auditor's procedures miss a material issue. Detection risk is the only component the auditor directly controls.

Why must an IS auditor exercise professional skepticism and due professional care?

To remain alert to conditions indicating possible error, fraud, or control weakness, critically assessing evidence rather than assuming management's representations are correct, thereby supporting reliable, defensible audit conclusions.