IT Controls
What this domain tests
IT controls questions test whether you can classify controls and place them where risk arises. You must distinguish general IT controls (access management, change management, operations, backup, physical security) from application controls (input, processing, output). Understand preventive, detective and corrective types, and manual versus automated controls. Expect scenarios on segregation of duties, privileged access, batch job monitoring, interface reconciliations and system development controls.
Frameworks and evidence
Know the purpose of control frameworks such as COBIT and the control objectives behind ITIL-style service management. Auditors seek evidence that a control operated throughout the period, not just at year end. A control that exists on paper but is not evidenced is a design-versus-operating-effectiveness gap. Understand compensating controls when a primary control cannot be implemented.
Traps that appear in questions
- Calling a reconciliation preventive; it is detective.
- Assuming automated controls need no testing; they need configuration and logic testing.
- Treating a policy document as proof a control operates.
- Confusing segregation of duties with least privilege; they are related but distinct.
- Ignoring change management, where unauthorised changes bypass every other control.
Worked example / rule of thumb
A clerk can both create a supplier and approve payments. That is a segregation-of-duties failure. The fix is to split the roles or add independent review. Rule of thumb: for any high-risk transaction, ask who initiates, who authorises, who records and who reconciles; if one person holds two conflicting roles, a control gap exists. When asked for the 'most effective' control, prefer one that prevents the error at source and is independently evidenced.
Exam technique
Map each scenario to a control category before choosing an answer. If an option describes a detective control where the question asks for prevention, discard it. Where a question asks what an auditor should do first, evidence gathering and understanding the process usually precede testing.
Security and Assurance
What this domain tests
Security and assurance covers the confidentiality, integrity and availability triad, risk assessment, and the controls that reduce risk to acceptable levels. Candidates should know authentication factors, access control models (role-based, discretionary, mandatory), encryption in transit and at rest, and the role of firewalls, patching and endpoint protection. Understand threats such as phishing, ransomware, insider misuse and social engineering, and the corresponding controls: awareness training, monitoring, incident response and business continuity.
Assurance and response
Assurance means obtaining confidence that controls work. Expect questions on penetration testing, vulnerability scanning, log review and audit trails. Know the incident response cycle: prepare, detect, contain, eradicate, recover, learn. Distinguish business continuity (keep operating) from disaster recovery (restore systems), and know recovery time and recovery point objectives. Privacy and breach notification duties often appear alongside.
Traps that appear in questions
- Confusing authentication (who you are) with authorisation (what you may do).
- Assuming encryption alone protects data if keys are poorly managed.
- Treating a vulnerability scan as a penetration test; scanning is broad and automated, testing is targeted and exploitative.
- Believing technology replaces user awareness; phishing defeats tools without trained people.
- Mixing continuity and recovery objectives.
Worked example / rule of thumb
A laptop holding customer data is stolen. If the disk is strongly encrypted and keys are held separately, the confidentiality risk is materially reduced, though the incident still requires assessment and possible notification. Rule of thumb: identify the asset, the threat, the vulnerability and the control, then judge residual risk. If residual risk exceeds tolerance, escalate rather than accept silently.
Exam technique
Look for the asset and threat in the stem, then match the control type. Prefer layered, proportionate responses; absolute security is not an option. Where asked for the 'first' action in an incident, containment usually precedes root-cause analysis.