Risk, Compliance, and Audit
Core concepts
This domain ties IAM controls to risk management, regulatory obligations, and evidence. Understand risk assessment (likelihood × impact), control types (preventive, detective, corrective), and how IAM controls map to frameworks and regulations (e.g., least privilege, access reviews, logging). Know audit fundamentals: evidence collection, sampling, segregation of duties in the audit process, and audit trails that are complete, tamper-evident, and retained per policy.
Study key IAM metrics and indicators: orphan/dormant account counts, certification completion rates, time-to-deprovision, MFA coverage, privileged account inventory, and exception aging. Understand exception management (documented, time-bound risk acceptances) and policy lifecycle (draft, approve, publish, review). Recognize logging and monitoring requirements: who accessed what, when, from where, and whether the action succeeded-feeding SIEM and incident response.
Traps
Examiners often confuse detective controls (access reviews, log monitoring) with preventive ones (policy enforcement, SoD rules at request time). Another trap: treating a risk acceptance as a permanent fix-acceptances must be documented, owned, and time-bound. Watch for audit questions where the right answer is complete, retained, tamper-evident logs rather than "more reports."
Rule of thumb
For any control question, classify it: prevents the event, detects it, or corrects it-then ask what evidence proves it operated. A control without retained evidence fails audit even if it technically works.