CS Professional Information Technology and Systems Audit Syllabus

Information Technology and Systems Audit syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Information Technology and Systems Audit in CS Professional, not a summary of it.

1. 1

   Information Technology

   3 topics

   • IT Infrastructure
   • IT Governance
   • Emerging Technologies
2. 2

   Systems Audit

   3 topics

   • Audit Planning
   • Audit Execution
   • Audit Reporting

Information Technology and Systems Audit flashcards for CS Professional

23 of 51 cards from the Information Technology and Systems Audit deck — real questions with worked answers.

1. What is IT infrastructure?

   The composite set of hardware, software, networks, data centres and facilities used to develop, test, deliver, monitor and support IT services within an organisation.

2. What are the three core layers of IT infrastructure?

   Hardware (servers, storage, devices), Software (OS, middleware, applications), and Network (LAN, WAN, internet, communication links).

3. Differentiate between LAN and WAN.

   A LAN (Local Area Network) connects devices within a limited area like an office; a WAN (Wide Area Network) spans large geographic areas, often linking multiple LANs across cities or countries.

4. What is virtualization in IT infrastructure?

   The creation of a virtual (software-based) version of a resource such as a server, storage device, or network, allowing multiple virtual machines to run on one physical machine.

5. What is a Data Centre Tier classification (Uptime Institute)?

   Tier I (basic, ~99.671% uptime), Tier II (redundant components), Tier III (concurrently maintainable, ~99.982%), Tier IV (fault tolerant, ~99.995% uptime).

6. What are the three cloud service models?

   IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and SaaS (Software as a Service).

7. What are the four cloud deployment models?

   Public cloud, Private cloud, Community cloud, and Hybrid cloud.

8. What is RAID in storage infrastructure?

   Redundant Array of Independent Disks - a method of combining multiple physical disks into one logical unit for redundancy, performance, or both (e.g., RAID 0 striping, RAID 1 mirroring, RAID 5 striping with parity).

9. Differentiate between RTO and RPO.

   RTO (Recovery Time Objective) is the maximum acceptable time to restore a system after disruption; RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how far back the last usable backup must be).

10. What is the difference between a hot site, warm site, and cold site?

    A hot site is fully equipped and operational for immediate failover; a warm site has hardware/connectivity but needs data restoration; a cold site provides only space and power, requiring full setup before use.

11. What is middleware?

    Software that acts as a bridge between an operating system or database and applications, enabling communication and data management for distributed applications.

12. What is IT governance?

    The framework of leadership, organisational structures and processes that ensure IT sustains and extends the organisation's strategies and objectives, aligning IT with business goals.

13. Name the five focus areas of IT governance.

    Strategic Alignment, Value Delivery, Resource Management, Risk Management, and Performance Measurement.

14. What is COBIT?

    Control Objectives for Information and Related Technologies - a framework by ISACA for IT governance and management of enterprise IT, aligning IT goals with business objectives.

15. What are the five principles of COBIT 5?

    1) Meeting stakeholder needs, 2) Covering the enterprise end-to-end, 3) Applying a single integrated framework, 4) Enabling a holistic approach, 5) Separating governance from management.

16. How does COBIT distinguish governance from management?

    Governance (EDM domain) ensures stakeholder needs are evaluated and direction set (responsibility of the board); management plans, builds, runs and monitors activities in line with that direction (responsibility of executive management).

17. What is ITIL?

    Information Technology Infrastructure Library - a framework of best practices for IT Service Management (ITSM) focused on aligning IT services with business needs across the service lifecycle.

18. What is the purpose of ISO/IEC 27001?

    It is the international standard specifying requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS).

19. What is the CIA triad in information security?

    Confidentiality (preventing unauthorised disclosure), Integrity (ensuring accuracy and completeness), and Availability (ensuring authorised access when needed).

20. What is a RACI matrix in IT governance?

    A responsibility assignment chart defining who is Responsible, Accountable, Consulted, and Informed for each task or decision.

21. What does segregation of duties (SoD) mean as an IT control?

    Dividing responsibilities among different people so that no single individual controls all phases of a transaction, reducing the risk of fraud and error.

22. What are general controls versus application controls?

    General (IT) controls apply to the overall IT environment (access, change management, operations); application controls are specific to individual applications, ensuring input, processing and output accuracy and completeness.

23. What are the three categories of application controls?

    Input controls, Processing controls, and Output controls.

See more Information Technology and Systems Audit flashcards →

Planning Information Technology and Systems Audit for CS Professional

Information Technology and Systems Audit (CS Professional) FAQ