CISA cheat sheet

Audit risk model: Audit risk = inherent risk x control risk x detection risk. Detection risk is the only component the auditor controls, and it moves inversely to the extent of substantive testing.

Evidence is judged on sufficiency (quantity) and appropriateness (relevance plus reliability). Evidence obtained directly by the auditor outranks management representations and verbal third-party statements.

Compliance testing asks whether a control exists and operates as designed; substantive testing asks whether transactions or balances are complete and accurate. Controls are tested first, then the amounts they should protect.

Attribute sampling suits control deviation rates (upper deviation limit at a stated confidence); variable sampling suits monetary amounts; stop-or-go and discovery sampling fit a single yes/no question such as whether any exception exists.

CAAT families: generalized audit software for extraction and comparison, test data with known good and bad inputs, integrated test facility using a dummy entity in a live system, parallel simulation, and snapshot.

The audit charter is approved by the board or audit committee and defines authority, scope, responsibilities and reporting lines; reporting to the audit committee protects independence.

Independence rule: the IS auditor may review, observe and advise on control design but must not design, implement or operate the controls being audited.

A finding contains five elements: criteria, condition, cause, effect (risk) and recommendation, followed by a management response with an owner and a remediation date.

SOC 1 reports address controls relevant to financial reporting, SOC 2 addresses trust services criteria, SOC 3 is a general-use seal; Type 1 is as of a point in time, Type 2 covers a period.

Governance versus management: governance evaluates, directs and monitors (ISO/IEC 38500); management plans, builds, runs and monitors within that direction.

COBIT principles include providing stakeholder value, a holistic approach, a dynamic governance system, governance distinct from management, tailoring to enterprise needs, and end-to-end coverage.

The board or audit committee is accountable for IT governance and IT risk; the IT steering committee prioritizes investments, allocates resources and resolves cross-functional conflicts.

Balanced scorecard perspectives are financial, customer, internal business process, and learning and growth; KGIs measure whether outcomes were achieved, KPIs measure process performance.

Document hierarchy: policy states mandatory management intent, standards set mandatory specific requirements, procedures give mandatory step-by-step instructions, and guidelines are discretionary recommendations.

Effectiveness means objectives were attained; efficiency means the resources consumed to attain them. Performance reporting addresses both.

A business case contains costs, benefits, risks, ROI and TCO; it is approved before funding and its benefits are verified at the post-implementation review.

Segregation of duties and least privilege limit fraud opportunity; mandatory vacations and job rotation expose concealed or collusive activity.

Framework mapping: TOGAF (architecture development method) and Zachman (architecture taxonomy) for enterprise architecture, ITIL for service management, COBIT for IT governance.

SDLC sequence with formal sign-off gates: feasibility and business case, requirements, design, build or acquire, test, implement, post-implementation review.

Test order: unit (developer) then integration, system, user acceptance (business) and regression; volume and stress tests probe capacity limits rather than functional correctness.

Project metrics: CV = EV - AC, SV = EV - PV, CPI = EV/AC, SPI = EV/PV. A value below 1 signals budget overrun (CPI) or schedule slippage (SPI); the critical path has zero float.

Change management flow: request, impact analysis, authorization, testing in a non-production environment, user sign-off, controlled migration. Developers must not promote their own code.

Input controls include field/format, size, range or limit, validity (table lookup), reasonableness, dependency, check digit and batch control totals.

Processing controls include run-to-run totals, control totals, record and file counts, reconciliation, and reasonableness checks on computed values.

Output controls cover distribution lists, spool and report protection, reconciliation of output to control totals, and retention.

Cutover options: direct or big bang (cheapest, riskiest), parallel (safest, costliest), pilot (single site or unit), phased (module by module).

Application controls act on individual transactions; general controls such as change management, logical access and operations provide the environment on which application controls depend.

The business impact analysis precedes recovery strategy: it identifies critical processes, dependencies and the escalating impact of an outage over time, producing priorities, RTOs and RPOs.

RTO must not exceed the maximum tolerable downtime; RPO sets backup and replication frequency; availability is approximated by MTBF / (MTBF + MTTR).

Backup types: full (copies all, resets the archive bit), incremental (changes since the last backup of any type, resets the bit), differential (changes since the last full, does not reset the bit). Restore chains therefore differ.

Grandfather-father-son rotation with offsite vaulting is standard; restoration must be tested periodically, and backup media should be encrypted at rest and in transit.

Alternate site ranking: hot (mirrored, minutes, highest cost), warm (partially equipped, hours to days), cold (shell only, weeks); reciprocal agreements and mobile sites are low-cost, low-assurance options.

DR test escalation by rigour and risk: checklist review, tabletop or structured walkthrough, simulation, parallel test, full interruption (most realistic, highest risk).

ITIL distinctions: incident management restores service quickly, often via a workaround; problem management removes root cause; change management controls alterations; configuration management maintains the CMDB.

Data centre controls: raised floor, temperature and humidity control, water detection, clean-agent fire suppression (Halon withdrawn), UPS plus generator, and elimination of single points of failure.

Operations monitoring: automated scheduling with job dependencies, review of console and exception reports, capacity and performance monitoring, and disciplined patch and problem management.

Risk = likelihood x impact, arising from threat and vulnerability; treatments are mitigate, transfer, accept and avoid, with acceptance documented by the accountable owner. Controls are preventive, detective or corrective and layered for defense in depth.

Access sequence: identification, authentication, authorization, then accountability through logging; least privilege and need-to-know govern what is authorized.

Authentication factors are something you know, something you have and something you are; multi-factor requires two or more different categories, so two passwords or a password plus PIN do not qualify.

Biometric metrics are FAR, FRR and CER; a lower crossover error rate means better accuracy. High FAR risks unauthorized access, high FRR risks locking out legitimate users.

Symmetric algorithms (AES) are fast but suffer key distribution problems; asymmetric algorithms (RSA, ECC) solve distribution but are slow, so hybrid schemes encrypt a symmetric session key asymmetrically.

Hashing (SHA-2, SHA-3) provides integrity only; a digital signature is a hash encrypted with the sender's private key and gives integrity, authenticity and nonrepudiation but not confidentiality.

Digital certificates bind an identity to a public key and are issued by a certification authority; validity is checked via CRL or OCSP within a PKI that includes registration authority and repository.

Network controls: firewall rule sets and ACLs, a DMZ for public-facing services, IDS for detection and alerting, IPS inline for blocking, proxy and NAT to mask internal addressing, TLS/IPSec for data in transit.

Forensics: preserve chain of custody and follow order of volatility (registers and cache, RAM, swap and temp files, disk, logs, backups and archival media), using write blockers on storage media.