ETiCPA ATQE Exam study guide
ETiCPA ATQE Exam · Work through your exam, one topic at a time.
The ETiCPA ATQE (often shortened to ATQE) is a professional certification examination aimed at people who audit, govern, or assure information technology. It suits IT auditors, internal and external audit staff moving into technology work, risk and compliance officers, and control owners in IT operations, security, and change management. The ETiCPA ATQE Exam study guide has 9 sections and about 3,732 words.
01IT Governance and IT Risk Management
Domain 1 examines whether you can separate governance from management, connect IT objectives to business strategy, and judge whether risk is identified, measured and held inside the appetite the board has set. Questions here are usually judgement-based: you are given a scenario and asked what the auditor should conclude, report or escalate.
435 words, about 2 min02IT General Controls and Control Frameworks
Domain 2 tests whether you understand the controls that make the rest of the audit trustworthy. Application controls and business controls are only as reliable as the IT general controls underneath them, so the exam asks you to classify controls, judge design against operating effectiveness, and evaluate third-party assurance reports.
456 words, about 2 min03Audit Planning, Scoping and Risk Assessment
Domain 3 tests how you turn an annual plan into a specific engagement: what question you will answer, where the boundaries lie, what criteria you measure against, and how risk drives the depth of work. Score the universe on change, complexity, transaction volume, regulatory exposure, third-party dependency and prior findings.
408 words, about 2 min04Audit Evidence, Testing and Sampling
Domain 4 is about evidence quality and honest evaluation of results: is what you gathered enough, is it relevant, and does your sample support the conclusion you intend to write? Sufficiency is quantity; appropriateness is relevance plus reliability.
419 words, about 2 min05IT Operations, Service Management and Business Continuity
Domain 5 covers the operational backbone: service management practices, batch and backup operations, and the continuity arrangements that keep commitments to the business when something fails. Incident management restores service; problem management removes root cause; change management controls modification.
419 words, about 2 min06Information Security and Cybersecurity Controls
Domain 6 tests whether you can evaluate security controls as controls (designed, implemented and operating) rather than as a list of technologies. Confidentiality, integrity and availability, with accountability as the practical fourth element.
351 words, about 2 min07System Development, Change and Project Management
Domain 7 covers how systems get built and changed, and how projects are governed: the controls that stop unauthorised or untested code reaching production, and the controls that stop projects consuming budget without delivering. Stage gates with defined deliverables, and requirements traceability from design through build to test.
407 words, about 2 min08Data Management, Privacy and Emerging Technology
Domain 8 tests data governance, privacy obligations and the assurance approach for newer technology, where the auditor often has less direct visibility and more dependence on third parties. Assign ownership and stewardship, classify data (public, internal, confidential, restricted), set retention and destruction schedules, and operate data loss prevention.
408 words, about 2 min09Audit Reporting, Communication and Follow-up
Domain 9 is where the work becomes useful or wasted: writing findings that survive challenge, communicating them without alarming or softening, and following up until risk is genuinely reduced. Condition: what is, with the population and exception count.
429 words, about 2 min