CISA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Audit risk model

Audit risk equals inherent risk multiplied by control risk multiplied by detection risk; detection risk is the only element the auditor controls, and it decreases as substantive testing increases.

Compliance testing purpose

Compliance testing determines whether a control exists and operates as designed throughout the period; substantive testing instead verifies the completeness, accuracy and validity of transactions or balances directly.

Audit evidence sufficiency

Sufficiency is the quantity of evidence needed to support a conclusion; appropriateness is its relevance and reliability. Evidence obtained directly by the auditor is more reliable than management representations.

Audit charter

A board or audit-committee-approved document defining the internal audit function's authority, scope, responsibilities and reporting lines, granting access to records and personnel, and underpinning auditor independence.

Integrated test facility

A computer-assisted audit technique that inserts a fictitious entity into a live production system so test transactions are processed alongside real ones and results are compared with expected output.

Audit finding components

A finding states the criteria (the standard), condition (what exists), cause, effect or risk, and a recommendation; management then provides a response with an owner and target remediation date.

Governance versus management

Governance evaluates, directs and monitors IT on behalf of stakeholders through the board; management plans, builds, runs and monitors IT activities within the direction that governance sets.

IT steering committee

A group of senior business and IT executives that prioritizes IT investments, allocates resources, resolves cross-functional issues and monitors project, service and risk performance.

KGI versus KPI

Key goal indicators measure whether intended business outcomes were achieved after the fact; key performance indicators measure how well an enabling process is currently performing.

IT balanced scorecard

A performance framework with financial, customer, internal process, and learning and growth perspectives, adapted for IT to show IT's contribution to business value and user satisfaction.

Data owner and custodian

The data owner, usually a business manager, classifies information and authorizes access; the data custodian, usually in IT, implements and administers the technical safeguards that protect it.

User acceptance testing

Testing performed and formally signed off by business users to confirm the system meets documented requirements; the auditor reviews coverage, defect closure and sign-off evidence rather than executing tests.

Cost performance index

Earned value divided by actual cost. A CPI below 1 means the project is over budget; a schedule performance index below 1 means the project is behind schedule.

Critical path

The longest sequence of dependent project activities, having zero float; any delay to an activity on the critical path delays the entire project completion date.

Parallel changeover

Old and new systems run simultaneously for a period and outputs are reconciled. It offers the highest confidence at the highest cost and suits high-risk conversions.

Developer production access

Developers should not be able to promote their own code into production; a separate release or operations function moves only tested, independently approved changes into the live environment.

Post-implementation review

A structured assessment after the system has stabilized, confirming that project objectives and expected benefits were achieved and identifying remaining issues and lessons learned.

Recovery time and point objectives

RTO is the maximum acceptable restoration time; RPO is the maximum acceptable data loss measured in time before the outage. RTO must fall within the maximum tolerable downtime.

Business impact analysis

The first continuity planning step: it identifies critical processes, dependencies and the escalating impact of an outage over time, producing recovery priorities, RTOs and RPOs.

Differential backup

Copies all files changed since the last full backup and does not reset the archive bit; restoration needs the last full backup plus only the most recent differential.

Incremental backup

Copies only data changed since the most recent backup of any type and resets the archive bit; restoration requires the last full backup plus every incremental taken since then, in order.

Hot site

A fully equipped alternate processing facility with current mirrored data and ready hardware, providing near-zero recovery time at the highest ongoing subscription cost.

Full interruption test

A disaster recovery test that shuts down the primary site and processes work at the alternate site; it is the most realistic and riskiest test and follows simpler tests.

Incident versus problem management

Incident management restores normal service as quickly as possible, often through a workaround; problem management then investigates root cause to prevent recurrence.

Crossover error rate

The point at which a biometric system's false acceptance rate equals its false rejection rate; a lower crossover error rate indicates a more accurate and better-balanced device.

Digital signature

A message hash encrypted with the sender's private key. It provides integrity, origin authentication and nonrepudiation, but because the message stays readable it gives no confidentiality.

Mandatory access control

A model in which the system enforces access based on security labels on objects and clearances held by subjects; users cannot change or delegate those permissions themselves.

Order of volatility

Evidence collection sequence from most to least volatile: processor registers and cache, RAM, swap and temporary files, disk storage, logs, then backups and archival media.

Chain of custody

An unbroken documented record of who collected, handled and analysed evidence, and when and why, required to demonstrate integrity and make evidence admissible in proceedings.

IDS versus IPS

An intrusion detection system monitors traffic passively and raises alerts; an intrusion prevention system is deployed inline and can automatically block or drop malicious traffic in real time.

Asymmetric encryption use

A public key encrypts and the matching private key decrypts, solving key distribution; because it is slow, it typically wraps a symmetric session key in hybrid encryption.

Data remanence

Residual data left on media after deletion or formatting; only clearing, purging such as degaussing, or physical destruction reliably removes it before disposal or reuse.