ISACA Certified Information Systems Auditor

Auditors cannot examine everything, so they choose well. You build an audit universe, rate risk, set materiality and scope, and write an annual plan and an engagement program that follow from them.

• The audit universe and risk assessment
• Materiality and audit risk
• Setting objectives, scope and criteria
• Annual and engagement-level planning
• Writing an audit program
• Resources, skills and use of specialists

You build A risk-based annual audit plan for ten IT areas, with the rating logic shown.

Conclusions rest on evidence. You decide what evidence is reliable, sample populations with sound methods, use data analysis tools to test complete populations and document the work so others can rely on it.

• Evidence types and their reliability
• Interviews, observation and walkthroughs
• Statistical and non-statistical sampling
• Computer-assisted audit techniques
• Analyzing whole populations
• Working papers and documentation

You build A sampling plan and analytics test over a sample transaction population, with results documented.

Audit value comes from findings that people act on. You evaluate control design and operation, find root causes, write and rate findings, hold the closing discussion and follow up on remediation.

• Control objectives and control types
• Testing design and operating effectiveness
• Root cause analysis and materiality of findings
• Writing clear findings and recommendations
• Reporting to management and audit committees
• Follow-up and quality assurance of the audit

You build An audit report with rated findings for a test engagement, with management responses.

Controls follow governance. You assess how IT is governed, how strategy and architecture align with the enterprise, how roles are separated, and whether policies and performance measures work.

• Governance frameworks and how auditors use them
• IT strategy and its alignment with the business
• Steering committees and organizational structure
• Segregation of duties and role design
• Policies, standards and procedures
• Enterprise architecture and maturity models

You build An audit program for IT governance, with criteria, tests and sample evidence.

IT risk has to be managed like other enterprise risk. You audit risk practices, outsourcing and cloud arrangements, supplier oversight and the planning of capacity, budgets and skills.

• IT risk management practices
• Outsourcing and cloud service arrangements
• Vendor management and contract controls
• Capacity, financial and human resource management
• Quality management and performance measurement
• Auditing third-party assurance reports

You build A third-party risk audit of a cloud service provider, with questions and expected evidence.

Many control failures begin with how systems are chosen. You audit business cases, project governance, requirements and procurement, so that a system is bought or built for reasons that can be shown.

• Business cases and benefits realization
• Project governance and methodologies
• Requirements and feasibility
• Vendor selection, contracts and escrow
• Project risk and controls
• Auditing project status and closure

You build A project audit checklist applied to a sample project file, with findings noted.

Controls are cheapest to build into a system before release. You audit development methods from waterfall to agile and DevOps, testing, data migration, cutover and application controls, and review the system after go-live.

• Development methods and their control implications
• Testing types and test evidence
• Data conversion and migration controls
• Input, processing and output controls
• Cutover, go-live approval and post-implementation review
• Change, configuration and release management

You build An audit program for a system implementation, covering testing, migration and application controls.

Daily operations are where most control failures show. You audit asset and job management, incident and problem handling, service levels, databases and networks, and the way operations are measured.

• Hardware and software asset management
• Job scheduling and batch processing
• Incident, problem and service level management
• Database and network operations controls
• Capacity and performance monitoring
• Reviewing operations logs and reports

You build An audit program for IT operations, with tests of incident, problem and change records.

Resilience determines whether the business survives a failure. You audit impact analysis, continuity and recovery plans, backup design, alternate sites and the testing that proves the plans work.

• Business impact analysis and recovery objectives
• Continuity and disaster recovery plans
• Backup, replication and alternate sites
• Testing plans and learning from tests
• Plan maintenance and communication
• Auditing resilience end to end

You build A resilience audit of one critical process, comparing its stated objectives with tested ability.

Security starts with policy and ends with who can do what. You audit security governance, classification, identity and access management and physical and environmental controls.

• Security policy and governance
• Information asset classification
• Identity and access management
• Logical access paths and privileged access
• Physical and environmental controls
• Privacy and data protection obligations

You build An access control audit of one application, with user access review and privileged access tests.

Technical controls protect information in transit and at rest. You audit network and endpoint security, encryption and key management, cloud and virtualization, monitoring, vulnerability management and incident handling.

• Network architecture, firewalls and remote access
• Endpoint and mobile device security
• Encryption, PKI and key management
• Cloud and virtualization security
• Vulnerability management and testing
• Monitoring, incident response and forensics

You build A technical control review of a network segment and its monitoring, with test evidence.

One engagement uses all five areas. You plan the audit, gather and analyze evidence, test governance, change, operations and security controls for one process, and report to an audit committee.

• Scoping and planning from a risk assessment
• Gathering and analyzing evidence
• Testing controls across governance, change, operations and security
• Forming conclusions and rating findings
• Reporting and agreeing actions

You build A full audit file for one IT process: plan, working papers, findings and report.