CPA ISC cheat sheet

Residual risk = inherent risk after the mitigating effect of controls; the four risk responses are avoid, reduce, share/transfer, and accept.

Risk appetite is the aggregate level and type of risk an entity accepts in pursuing strategy; risk tolerance is the acceptable variance around that appetite.

COSO ERM components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting.

COBIT separates governance (EDM: Evaluate, Direct, Monitor) from management (APO, BAI, DSS, MEA) and defines processes and control objectives.

Three lines model: operating management owns risk (1st line), a risk and compliance function monitors it (2nd line), internal audit gives independent assurance to the board (3rd line).

SOC 1 covers controls relevant to user entities' financial reporting; SOC 2 covers the trust services criteria (security, availability, processing integrity, confidentiality, privacy); SOC 3 is a general-use summary without detail.

SOC report Type 1 = fairness of description and suitability of design at a point in time; Type 2 = design and operating effectiveness over a period.

IT general controls span access management, change management, IT operations, backup and recovery, and program development.

Segregation of duties separates authorization, custody of assets, and recordkeeping; a key risk indicator is a leading metric that signals rising risk exposure.

Data hierarchy: bit to byte/character, field, record, file/table, database.

ACID properties: atomicity (all or nothing), consistency (valid state transitions), isolation (concurrent transactions do not interfere), durability (committed data persists).

Normalization: 1NF eliminates repeating groups to atomic values; 2NF eliminates partial dependencies on a composite key; 3NF eliminates transitive dependencies on non-key attributes.

Three-schema architecture: external level (user views), conceptual level (logical model), internal level (physical storage).

A full backup copies all data; a differential copies changes since the last full backup; an incremental copies changes since the last backup of any type. Restoring incrementals requires the last full plus every incremental since.

RPO is the maximum tolerable data loss in time and drives backup frequency; RTO is the maximum tolerable downtime and drives recovery site and resource decisions.

A data warehouse stores cleansed, subject-oriented historical data structured for analysis; a data lake stores raw structured and unstructured data with schema-on-read; a data mart is a subject-specific subset.

Data quality dimensions: accuracy, completeness, consistency, timeliness, validity, uniqueness; metadata is data that describes other data.

Relational keys: a primary key uniquely identifies a row and cannot be null; a foreign key references a primary key in another table and enforces referential integrity.

CIA triad: confidentiality, integrity, availability; authentication proves identity, authorization determines permitted actions, and accounting logs activity.

Multi-factor authentication requires factors from at least two different categories: something you know, something you have, something you are.

Symmetric encryption (AES) uses one shared key, is fast, but requires secure key distribution; asymmetric encryption (RSA, ECC) uses a public/private pair and enables key exchange and digital signatures.

Hashing (e.g., SHA-256) is one-way and supports integrity; a digital signature provides integrity, authentication, and nonrepudiation but not confidentiality.

Access control models: discretionary (owner grants access), mandatory (labels and clearances), role-based (permissions tied to roles), attribute-based (policy evaluated on attributes).

An IDS monitors and alerts passively; an IPS is inline and blocks; a firewall filters traffic by rule; a DMZ hosts externally facing services outside the internal network.

Incident response lifecycle: preparation, detection and analysis, containment/eradication/recovery, post-incident review.

Privacy principles: lawfulness and purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability; personal data is any data identifying an individual.

Encryption at rest and in transit (TLS), key rotation, and separation of key custodian duties protect confidentiality; least privilege and need-to-know limit access.

SDLC phases: feasibility/planning, requirements, design, development, testing, implementation, maintenance, and post-implementation review.

Testing levels ascend from unit to integration to system to user acceptance; regression retests existing functions after a change; white-box tests code logic, black-box tests behavior.

Conversion strategies: direct (big bang) is lowest cost and highest risk; parallel is highest cost and lowest risk; phased and pilot fall between.

Change management controls: documented request, risk assessment, testing in a non-production environment, approval, segregated promotion to production, and post-implementation verification.

Developers should not hold production update access; development, test, and production environments are separated with distinct credentials and data.

Disaster recovery test methods in increasing rigor: checklist review, walkthrough, simulation, parallel test, full interruption test.

Emergency changes use abbreviated but still documented approval and testing, followed by retrospective review.

ITIL practices: incident management restores service, problem management finds root cause, change enablement controls modifications, service level management governs SLAs.

End-user computing risks include unversioned spreadsheets, hard-coded values, and absent access controls; mitigations are inventory, version control, and independent reconciliation.