CITP study guide
CITP · Work through your exam, one topic at a time.
The Certified Information Technology Professional (CITP) is an information technology credential associated with the accounting profession and offered in the AICPA & CIMA ecosystem. It is designed for professionals who bridge finance and technology - CPAs and other practitioners who audit systems, advise on IT risk, or lead technology initiatives inside accounting and finance functions. The exam's published domain structure covers information technology governance; information systems and infrastructure; information security, confidentiality, and privacy; and systems development, acquisition, and project management. That mix rewards candidates who can reason about controls, risk, and project delivery rather than recite product features. Topics on this exam: Information Technology Governance, Information Systems and Infrastructure, Information Security, Confidentiality, and Privacy, and Systems Development, Acquisition, and Project Management. The CITP study guide has 4 sections and about 1,743 words.
01Information Technology Governance
Domain 1 covers Information Technology Governance. CITP questions here test whether you can evaluate how an entity directs, controls, and monitors IT so technology supports strategy and stays inside risk appetite. Expect board, audit-committee, and CIO scenarios that ask you to spot a governance gap, choose the right framework, or judge whether a control is designed and operating effectively. COBIT 2019 separates the two.
474 words, about 2 min02Information Systems and Infrastructure
Domain 2 covers Information Systems and Infrastructure. The exam tests whether you understand the components that deliver processing and can reason about availability, integrity, and recovery - not whether you can configure a router. Hardware and operating systems host virtualization and containers; networks move data using TCP/IP across LANs and WANs; database management systems store data under ACID properties (atomicity, consistency, isolation, durability); applications such as ERP and CRM sit on top. Cloud service models shift control: IaaS gives infrastructure, PaaS gives a platform, SaaS gives a finished application.
414 words, about 2 min03Information Security, Confidentiality, and Privacy
Domain 3 covers Information Security, Confidentiality, and Privacy. CITP questions test whether you can select controls based on risk, protect sensitive data, and distinguish a security incident from a privacy obligation. Risk is likelihood times impact. Controls can be preventive (access restrictions, firewalls), detective (logging, IDS, reconciliation), or corrective (restore, incident response).
414 words, about 2 min04Systems Development, Acquisition, and Project Management
Domain 4 covers Systems Development, Acquisition, and Project Management. The exam tests whether you can follow a system from requirements to retirement, keep development controls segregated, and interpret project performance metrics. A traditional SDLC runs requirements, design, build, test, implement, and maintain, with approvals at each gate. Agile delivers in iterations with continuous feedback, but it does not remove controls: product backlog, definition of done, peer review, automated testing, and change traceability still apply.
441 words, about 2 min