CISA case studies
CISA · Put your knowledge to work in context.
The Certified Information Systems Auditor (CISA) credential, awarded by ISACA, is described by ISACA as the standard of achievement for auditing, monitoring and assessing IT and business systems. It is aimed at IT audit, assurance, control and security professionals who assess technology risk, and holders agree to ISACA's Code of Professional Ethics and to the Information Systems Auditing Standards. The CISA case studies are 5 cases and about 4,392 words.
1The Change Log That Shrinks When You Ask For It
You are the audit lead for a review of a retail bank's loan-origination system. You requested the full change log for the past 12 months - roughly 1,400 changes - to test whether changes were approved before deployment.
848 words, about 4 min2The SaaS Contract That Never Went Through IT
A marketing director signs a three-year SaaS contract for a customer-data platform at USD 180,000 per year, charged to the department's discretionary budget. Because it falls under the USD 250,000 capital approval threshold, no board or IT review was triggered.
883 words, about 4 min3Two Weeks From Go-Live With 8,400 Orphan Records
A 14-month ERP replacement is two weeks from go-live. Data migration from the legacy system has been run four times.
846 words, about 4 min4Eleven Hours Against a Four-Hour Promise
A payments processor's BCP states an RTO of 4 hours and an RPO of 15 minutes for its core transaction system. In the annual DR test, failover to the secondary site took 11 hours.
925 words, about 5 min5Two Admin Accounts, Six Engineers, One Departed
A hospital's EHR is administered by six engineers who share two domain administrator accounts because 'individual accounts break the ETL jobs.' The passwords sit in a shared vault the whole team can open. Logs show the two accounts performed 340 privileged actions last month, 60 of them between 01:00 and 04:00.
890 words, about 4 min