CS Professional Information Technology and Systems Audit Syllabus

What does segregation of duties (SoD) mean as an IT control?

Dividing responsibilities among different people so that no single individual controls all phases of a transaction, reducing the risk of fraud and error.

What are general controls versus application controls?

General (IT) controls apply to the overall IT environment (access, change management, operations); application controls are specific to individual applications, ensuring input, processing and output accuracy and completeness.

What are the three categories of application controls?

Input controls, Processing controls, and Output controls.

What is Cloud Computing's defining characteristic (NIST)?

On-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service - delivering computing resources over the internet on a pay-per-use basis.

What is Big Data and its characteristics (the Vs)?

Extremely large/complex data sets characterised by Volume, Velocity, Variety, Veracity, and Value, requiring specialised tools to process.

What is Artificial Intelligence (AI)?

The simulation of human intelligence by machines, enabling them to perform tasks such as learning, reasoning, problem-solving and decision-making.

How does Machine Learning differ from AI?

Machine Learning is a subset of AI in which systems learn patterns from data and improve performance over time without being explicitly programmed for each task.

What is Blockchain?

A distributed, decentralised digital ledger that records transactions across many computers in immutable, cryptographically linked blocks, so records cannot be altered retroactively.

What is the Internet of Things (IoT)?

A network of physical objects embedded with sensors, software and connectivity that collect and exchange data over the internet without human intervention.

What is Robotic Process Automation (RPA)?

Software robots (bots) that automate repetitive, rule-based digital tasks such as data entry, reconciliations and form filling, mimicking human interactions with systems.

What is a smart contract?

Self-executing code stored on a blockchain that automatically enforces and executes the terms of an agreement when predefined conditions are met.

What is edge computing?

A model that processes data near its source (at the network edge) rather than in a centralised data centre, reducing latency and bandwidth usage.

What is a digital twin?

A virtual replica of a physical object, process or system used for simulation, monitoring and analysis in real time.

What is a systems audit?

An independent examination and evaluation of an organisation's IT systems, infrastructure, policies and operations to assess controls, security, integrity and compliance.

What are the main objectives of an IT/systems audit?

To evaluate confidentiality, integrity and availability of information, ensure compliance with laws and policies, assess effectiveness of controls, and safeguard IT assets.

What are the typical phases of an IT audit?

Planning, Risk assessment, Audit execution (fieldwork/testing), Reporting, and Follow-up.

What is included in IT audit planning?

Understanding the business and IT environment, defining scope and objectives, performing risk assessment, determining materiality, allocating resources, and preparing the audit programme.

What is audit scope?

The boundary of the audit defining which systems, processes, locations and time periods will be examined.

What is materiality in the context of an audit?

The threshold above which a misstatement or control weakness is significant enough to influence the decisions of users of the information/report.

What is risk-based audit planning?

An approach that prioritises audit effort towards areas with the highest risk, where Audit Risk = Inherent Risk x Control Risk x Detection Risk.

Define inherent risk, control risk and detection risk.

Inherent risk is susceptibility to error/fraud assuming no controls; control risk is the risk that controls fail to prevent/detect errors; detection risk is the risk that audit procedures fail to detect a material misstatement.

What is an audit charter?

A formal document that defines the audit function's purpose, authority, responsibility and accountability, approved by the board or audit committee.

What is an audit programme?

A detailed, step-by-step plan listing the specific audit procedures to be performed to achieve the audit objectives.

What are CAATs?

Computer-Assisted Audit Techniques - software tools and techniques (e.g., ACL, IDEA, generalised audit software) used by auditors to analyse data, test controls and detect anomalies.

What is the difference between a test of controls and a substantive test?

A test of controls evaluates whether internal controls operate effectively; a substantive test verifies the accuracy and completeness of actual data/transactions and account balances.

What is audit sampling?

Applying audit procedures to less than 100% of items in a population so that conclusions about the entire population can be drawn from the sample.

What is the difference between statistical and non-statistical sampling?

Statistical sampling uses random selection and probability theory to quantify sampling risk; non-statistical (judgmental) sampling relies on the auditor's judgment without measuring sampling risk mathematically.

What is audit evidence and what makes it sufficient and appropriate?

Information used by the auditor to draw conclusions; it is sufficient when adequate in quantity and appropriate when relevant and reliable to support audit findings.

What are audit working papers?

The documentation of audit evidence, procedures performed, information obtained and conclusions reached, supporting the audit opinion and providing a record of work done.

What are the essential components of an IT audit report?

Title and addressee, scope and objectives, period covered, methodology, findings/observations, risk rating, recommendations, management responses, and the auditor's conclusion/opinion.

Why is the follow-up phase important in IT audit reporting?

It verifies that management has implemented the agreed corrective actions/recommendations and that identified control weaknesses have been effectively remediated.