ETiCPA ATQE Exam study plan

Map the IT governance layer: distinguish board, audit committee, CIO, CISO and IT steering committee accountabilities, and write a one-page RACI for a fictional organization.

Build a risk register with at least 12 IT risks, scoring each on likelihood and impact and assigning an owner and a response type (avoid, mitigate, transfer, accept).

Explain how IT risk appetite and tolerance statements translate into control selection, and record three concrete examples of appetite-driven decisions.

Differentiate inherent, residual and target risk, and recompute the residual score for five register entries after applying a named control.

Draft a 10-question self-quiz on governance and risk terminology, then answer it closed-book and log any misses.

Decompose a recognized control framework (such as COSO Internal Control or COBIT) into its components and map each component to at least two IT general control examples.

Categorize ITGCs into change management, access to programs and data, computer operations, and program development, and list the typical control activities and evidence for each category.

Identify, for a sample of 15 controls, whether each is preventive, detective or corrective, and whether it is manual or automated.

Trace how a deficiency in one ITGC (for example, weak change approval) can cascade into financial reporting risk, and document two worked examples.

Write control descriptions in testable language, converting five vague control statements into specific, evidence-verifiable ones.

Draft an audit scope statement for a defined IT environment, explicitly listing in-scope systems, out-of-scope areas, the audit period and the applicable criteria.

Perform a risk-based scoping exercise that ranks five business processes by impact and selects the top three for testing, justifying each exclusion.

Design a test of control and a substantive test for the same assertion, and articulate when each is appropriate.

Select a sampling approach (attribute, statistical, haphazard, or targeted) for three scenarios and state the sample size rationale and the resulting conclusion logic.

Assemble an evidence log that records source, date, preparer, reliability rating and sufficiency judgment for ten pieces of evidence.

Design a walkthrough for one IT process and document the control points, owners and evidence generated at each step.

Evaluate evidence reliability by ranking inquiry, observation, inspection and reperformance for three audit assertions, and record the reasoning.

Explain the components of IT service management (incident, problem, change, configuration, service level) and identify the audit evidence each process produces.

Assess a business continuity and disaster recovery program: check for a completed business impact analysis, defined recovery time and recovery point objectives, and evidence of a tested plan.

Distinguish a cold, warm and hot site and state which recovery objective each supports.

Map the confidentiality, integrity and availability triad to at least three concrete security controls each and note the audit test for each control.

Evaluate identity and access management controls: provisioning, privileged access, periodic recertification, segregation of duties and termination timeliness, and specify the evidence for each.

Analyze a vulnerability and patch management lifecycle and identify where an auditor would test for completeness and timeliness.

Explain defense in depth across network, endpoint, application and data layers, and describe one detective control at each layer.

Interpret a security incident response lifecycle and identify the evidence an auditor would request to confirm incidents were logged, escalated and closed.

Compare development methodologies (waterfall, agile, DevOps) and state the control implications of each for approval, testing and segregation of duties.

Trace a change from request through approval, testing, and deployment to production, and identify the three control points where an auditor would test.

Evaluate segregation of duties in a change process, specifically developer access to production, and describe a compensating control when it is unavoidable.

Assess project governance: business case approval, stage gates, risk tracking and post-implementation review, and list the artifacts each should produce.

Design a test for emergency changes that checks retrospective approval and documentation.

Classify data by sensitivity and map each class to retention, encryption and access requirements.

Explain the core obligations of a major privacy regime (such as GDPR or a local equivalent) in terms of lawful basis, data subject rights, breach notification and cross-border transfer, and identify the audit evidence for each.

Assess an emerging technology use case (for example, generative AI or cloud outsourcing) for control gaps in model governance, vendor oversight and data leakage.

Structure an audit finding using condition, criteria, cause, effect and recommendation, and rewrite three weak findings into that structure.

Draft a follow-up tracker that records management response, owner, due date and validation method for each finding.

Complete a timed 60-question mixed-domain practice set, then classify every miss by domain and root cause (knowledge gap, misread, or reasoning error).

Re-study the two weakest domains using your own week 1-7 deliverables as the review source rather than new material.

Rehearse explaining three complex control concepts aloud in under two minutes each, as if briefing an audit committee.

Consolidate a one-page formula and terminology sheet covering risk scoring, sampling logic, RTO/RPO, and finding structure.

Simulate a scoping decision under time pressure: given a scenario, produce scope, key risks and three tests in 20 minutes.