EXIN EPI Certified TIA-942 Internal Auditor cheat sheet

TIA-942 is a voluntary U.S. telecommunications infrastructure standard for data centres; it is not a law, certification scheme, or design specification.

The standard is organized into sections: scope, normative references, definitions, general requirements, and annexes covering reliability, redundancy, and topology.

Key terms: 'data centre' = building or space housing ICT equipment; 'telecommunications space' = area for cabling and equipment; 'entrance room' = demarcation point.

Redundancy levels are designated as N, N+1, 2N, and 2(N+1); 'N' means the minimum capacity required to support the load.

'Concurrently maintainable' means a component can be removed or serviced without shutting down the critical load.

'Fault tolerant' means the system can sustain a single failure without affecting the critical load.

TIA-942 distinguishes between 'redundancy' (spare capacity) and 'availability' (uptime), which are related but not identical.

The standard uses 'shall' for mandatory requirements and 'should' for recommendations; auditors must verify 'shall' statements.

Annexes provide informative guidance on topology, redundancy, and reliability; they are not normative requirements.

TIA-942 defines four redundancy levels: N (basic), N+1 (redundant), 2N (concurrently maintainable), and 2(N+1) (fault tolerant).

Level N: single path for power and cooling; no redundancy; downtime expected for any component failure.

Level N+1: one additional component beyond N; allows maintenance but not concurrent failure of critical path.

Level 2N: two complete independent paths; any single component can be removed without affecting load.

Level 2(N+1): two independent paths, each with N+1 redundancy; supports concurrent maintenance and fault tolerance.

Topology includes entrance room, main distribution area (MDA), horizontal distribution area (HDA), zone distribution area (ZDA), and equipment distribution area (EDA).

Redundancy level applies to power, cooling, and telecommunications infrastructure; each system must be assessed separately.

Cabling hierarchy: backbone cabling connects entrance room to MDA/HDA; horizontal cabling connects HDA to EDA.

The standard requires separation of power and telecommunications cabling to avoid electromagnetic interference.

Internal audit independence: auditors must not audit activities they are responsible for; objectivity is essential.

Audit programme: a documented set of audit activities, schedules, and resources for a defined period.

Risk-based planning: prioritize audit areas based on risk assessment (likelihood and impact of nonconformity).

Audit scope must be defined: boundaries, locations, systems, and standards to be audited.

Audit criteria: the set of policies, procedures, or standards (e.g., TIA-942) against which evidence is compared.

Audit plan includes: objectives, scope, criteria, schedule, team assignments, and audit methods.

Audit evidence must be sufficient, relevant, and reliable; sampling is used when full population is impractical.

Audit programme review: periodic evaluation of the programme's effectiveness and alignment with objectives.

Evidence types: documents, records, interviews, observations, and measurements; triangulate sources for reliability.

Audit techniques include: document review, interviews, observation, sampling, and walkthroughs.

Findings must be classified: conformity, nonconformity (major/minor), observation, or opportunity for improvement.

Objective evidence must be recorded: what was examined, where, when, and by whom.

Audit report structure: purpose, scope, criteria, summary, findings, conclusions, and recommendations.

Findings should reference the specific TIA-942 requirement (clause or section) and the evidence.

Report distribution: controlled; ensure confidentiality and data protection.

Audit records must be retained per organizational policy and legal requirements.

Corrective action: action to eliminate the cause of a nonconformity and prevent recurrence.

Follow-up verifies implementation and effectiveness of corrective actions within agreed timelines.

Root cause analysis: use methods like 5 Whys, fishbone diagram, or FMEA to identify underlying causes.

Nonconformity closure requires evidence of effective correction and corrective action.

Continual improvement: use audit results, trends, and performance indicators to improve the audit programme and the data centre.

Management review: top management reviews audit results and corrective action status.

Audit programme improvement: monitor audit effectiveness, auditor competence, and stakeholder feedback.

Records of follow-up activities must be maintained and traceable to the original finding.