CISA study plan

Map the IS audit function's roles, responsibilities, and reporting lines to the audit charter and ISACA standards

Build an audit program from a written scenario by selecting scope, objectives, and test procedures

Rank evidence types (observation, interview, inspection, reperformance) by reliability and justify each ranking

Explain how risk-based auditing drives audit universe prioritization and sampling decisions

Differentiate compliance, substantive, and control testing and pick the right one for three scenarios

Apply the audit risk model (inherent, control, detection risk) to compute and interpret engagement risk for two case studies

Distinguish preventive, detective, and corrective controls and classify 20 listed controls without error

Draft audit findings in the standard condition/criteria/cause/effect/recommendation structure

Describe the layered defense concept and place logical, physical, and administrative controls in the correct layer

Identify the auditor's responsibilities for fraud detection, follow-up, and reporting to management versus the board

Compare discretionary, mandatory, role-based, and rule-based access control models and select the appropriate model for four described environments

Distinguish symmetric encryption, asymmetric encryption, and hashing by purpose, key handling, and appropriate use case

Explain certificate authority trust chains and how digital certificates support authentication and nonrepudiation

Position firewalls, IDS/IPS, proxies, and VPNs in a network architecture and state what each does and does not protect

Apply a data classification scheme to assign handling, retention, and destruction requirements to sample data sets

Differentiate RTO, RPO, MTD, and MTBF and calculate each from supplied outage data

Match backup strategies (full, incremental, differential, mirroring, snapshot) to stated recovery objectives

Sequence incident response, problem management, and escalation steps for a simulated security event

Evaluate types of resilience testing (checklist, tabletop, simulation, parallel, full interruption) for cost and risk

Identify controls over job scheduling, capacity monitoring, and media handling in an operations walkthrough

Explain how IT operations management practices (change, configuration, problem, capacity) interact with business resilience

Design a backup rotation and offsite retention scheme that satisfies stated retention and recovery requirements

Audit a change management process by identifying where segregation of duties and approval evidence are required

Distinguish hot, warm, and cold recovery sites and justify site selection for two cost/risk profiles

Interpret monitoring, logging, and job-scheduling output to detect operational failures

Align IT strategy to enterprise objectives using a documented IT governance framework and identify misalignment symptoms

Distinguish policies, standards, procedures, and guidelines and place 15 sample statements into the correct category

Structure an enterprise IT risk register with likelihood, impact, risk response, and owner for six sample risks

Differentiate IT roles and structures (steering committee, CIO, data owner, data custodian, security officer) by accountability

Evaluate IT performance using maturity models and balanced scorecard metrics for a described organization

Sequence SDLC phases and specify the control activities and audit involvement appropriate to each phase

Compare waterfall, iterative, agile, and DevOps delivery models by where audit evidence is produced and retained

Evaluate test types (unit, integration, system, UAT, regression) and assign the correct owner and exit criteria for each

Audit change management and data migration controls including authorization, testing, and rollback planning

Define post-implementation review objectives and the criteria for deciding whether benefits were realized

Complete a full-length timed mock exam under exam-day conditions without reference material

Triage every missed question into a domain, a root cause (knowledge gap, misread, or reasoning error), and a remediation action

Re-study the three highest-error subdomains using condensed notes and targeted drills

Construct a one-page exam-day decision framework for eliminating distractors on scenario questions

Rehearse a time budget that allocates roughly one minute per question with flagged-question review