CISA study guide
CISA · Work through your exam, one topic at a time.
The Certified Information Systems Auditor (CISA) credential, awarded by ISACA, is described by ISACA as the standard of achievement for auditing, monitoring and assessing IT and business systems. It is aimed at IT audit, assurance, control and security professionals who assess technology risk, and holders agree to ISACA's Code of Professional Ethics and to the Information Systems Auditing Standards. The CISA study guide has 5 sections and about 1,495 words.
01Information Systems Auditing Process
An IS audit begins with the audit charter , which grants authority, defines scope and reporting lines, and must originate from the board or audit committee - never from IT management. Independence and objectivity underpin every answer: the auditor may recommend control improvements but must never design or operate a control, because that impairs objectivity.
303 words, about 2 min02Governance and Management of IT
IT governance is the board's and executives' responsibility: setting direction through leadership, organizational structure and processes so that IT sustains and extends business strategy. Management executes that direction.
281 words, about 1 min03Information Systems Acquisition, Development and Implementation
Typical SDLC phases: feasibility/business case, requirements definition, design, development or configuration, testing, implementation and post-implementation review. Auditor focus: an approved business case with measurable benefits, meaningful user involvement, documented requirements sign-off, segregation between developers and the production environment, and test data that is synthetic or masked rather than live production data.
312 words, about 2 min04Information Systems Operations and Business Resilience
Know the service management distinctions: incident management restores service quickly; problem management finds and eliminates root cause; change, release and configuration management (with a CMDB) control the environment. Service level agreements are with customers, operational level agreements are internal, underpinning contracts are with vendors.
283 words, about 1 min05Protection of Information Assets
Security is a business issue owned by senior management; the CISO advises and coordinates. A classification scheme (owner-assigned) drives handling rules.
316 words, about 2 min