CISA key terms

A formal, approved document that defines the IS audit function's purpose, authority, responsibility, and reporting lines. It establishes the auditor's right to access records and people and is approved at board or senior management level.

The risk that an auditor issues an inappropriate conclusion because material errors or control weaknesses went undetected. It combines inherent risk, control risk, and detection risk, and is managed by adjusting the nature, timing, and extent of testing.

The threshold at which an error, omission, or control weakness is significant enough to change a decision-maker's judgment. Auditors use it to decide which areas to test and which findings to report.

An approach that directs audit resources to the areas of greatest risk by first assessing likelihood and impact of failure. Higher-risk areas receive more attention, greater depth, and more frequent testing.

Testing that checks whether prescribed controls exist and operate as designed, for example verifying that approvals were obtained. It answers whether the control is working rather than confirming the accuracy of underlying amounts.

Detailed testing of transactions, balances, or records to detect errors or misstatements directly. It is used when controls are weak or to corroborate the results of compliance testing.

A facilitated process in which process owners and staff evaluate their own controls and identify risks and gaps. It broadens audit coverage and builds ownership, but auditors should validate the results.

Selecting a subset of a population so the auditor can draw conclusions about the whole. Sampling risk, the chance the sample is unrepresentative, is controlled through sample size and selection method.

The leadership, structures, and processes that ensure IT supports and extends business strategy, delivers value, and manages risk. It determines who decides, how priorities are chosen, and how performance is monitored.

An ISACA framework of governance and management objectives for enterprise IT. It links business goals to IT activities through defined processes, supporting maturity assessment, control design, and audit scoping.

A cross-functional executive group that sets IT priorities, approves major investments and projects, and resolves conflicts between business units. It provides oversight and ensures IT initiatives align with strategy.

A blueprint describing an organization's business, data, application, and technology layers and how they relate. It guides standards and investment so systems remain integrated, scalable, and aligned with strategy.

Managing IT investments as a portfolio by evaluating, prioritizing, and monitoring projects and assets against strategic value and risk. It helps terminate low-value work and balance spending across the organization.

The amount and type of IT-related risk an organization is willing to accept in pursuit of its objectives, stated qualitatively or quantitatively. It guides decisions on controls, projects, and outsourcing arrangements.

Splitting critical tasks such as authorization, custody, recording, and review among different people so no one person can both cause and conceal an error or fraud. In IT it also separates development, testing, and production.

The structured phases used to build or acquire a system, typically initiation, feasibility, requirements, design, development, testing, implementation, and post-implementation review. Controls at each phase reduce the cost of late defects.

An assessment of whether a proposed system is technically achievable, economically justified, and legally and operationally viable before major spending. It typically compares alternatives and recommends a course of action.

Controls built into a business application covering input, processing, and output, such as edit checks, validation rules, reconciliation, and report distribution. They help ensure transactions are complete, accurate, authorized, and timely.

Testing performed by business users with realistic data to confirm a system meets requirements and is fit for use before go-live. Formal sign-off transfers ownership from the project team to the business.

A formal process for requesting, assessing, approving, testing, and documenting modifications to software or configuration. It prevents unauthorized or untested changes from reaching production and keeps versions traceable.

A scheduling technique that identifies the longest sequence of dependent tasks in a project, which determines the shortest possible completion time. Any delay on the critical path delays the entire project.

A structured review after a system goes live that compares actual costs, benefits, and performance with the original business case, and records lessons learned and unresolved issues.

A study identifying critical business processes, their dependencies, and the financial and operational impact of disruption over time. Its outputs set recovery priorities and the recovery time and recovery point objectives.

The maximum acceptable time a business process or system can be unavailable after a disruption. It drives recovery strategy choices such as site type and redundancy, and must be validated through testing.

The maximum acceptable amount of data loss, measured in time, before a disruption, effectively how far back the last usable copy may be. It drives backup and replication frequency.

Documented procedures to restore critical IT infrastructure, data, and applications at an alternate facility after a major disruption. It supports the business continuity plan and should be tested on a regular schedule.

A plan describing how an organization will keep delivering critical business functions during and after a disruption, covering people, facilities, suppliers, and communications. It is broader than, and dependent on, IT recovery planning.

The process of detecting, logging, classifying, escalating, resolving, and closing service incidents to restore normal operation quickly, while limiting business impact and preserving information for later root-cause analysis.

The process of finding and eliminating the root causes of recurring incidents through trend analysis, known-error records, and permanent fixes. Unlike incident management, which restores service, it aims to reduce incident volume.

The set of policies, procedures, roles, and controls an organization uses to manage information security risk, often built on ISO/IEC 27001. It follows a continual improvement cycle of plan, do, check, and act.

The three core goals of information security: confidentiality, meaning only authorized parties access data; integrity, meaning data is accurate and unaltered; and availability, meaning systems and data are accessible when needed.

An access model in which permissions are assigned to roles based on job function and users are granted roles. It simplifies administration and supports least privilege and segregation of duties.

The policies, software, and certificate authorities that issue, distribute, and revoke digital certificates binding public keys to identities. It underpins encryption, authentication, and digital signatures across untrusted networks.

A cryptographic value created with a sender's private key and verified with the corresponding public key, proving the message's origin and that it was not altered. It provides authenticity, integrity, and nonrepudiation.

A tool that monitors network or host activity and alerts on suspicious patterns or policy violations. A detection-only control; an intrusion prevention system additionally blocks the traffic it identifies as malicious.

Assigning data to categories such as public, internal, confidential, or restricted according to sensitivity and legal obligations. The category then determines handling, access, retention, and protection requirements.

An authorized, simulated attack that exploits vulnerabilities to determine how far an intruder could get and what damage is possible. It complements, but does not replace, routine vulnerability scanning.