GIP Professional Exam cheat sheet

COSO ERM: 5 components (governance & culture, strategy & objective-setting, performance, review & revision, information/communication/reporting) and 20 principles.

Three lines model: line 1 owns and manages risk; line 2 provides independent oversight and challenge; line 3 (internal audit) gives independent assurance to the governing body.

Risk = likelihood x impact; inherent risk is assessed before controls, residual risk after controls; risk appetite is the amount of risk an organization is willing to accept in pursuit of objectives.

Control types: preventive, detective, corrective, directive; categories: administrative, technical, physical; a compensating control substitutes when a primary control cannot be applied.

ISO 31000 risk process: establishing context, risk identification, analysis, evaluation, treatment (avoid, reduce, transfer, accept), monitoring and review.

Compliance obligation sources: statutes and regulations, contractual terms, industry standards, internal policy; a compliance register maps each obligation to an owner and control.

Key risk indicators (KRIs) are leading metrics with thresholds; key performance indicators (KPIs) measure operational achievement, not risk exposure.

Segregation of duties is a preventive control that splits authorization, custody, and record-keeping among different people; collusion defeats it.

CIA triad: confidentiality (authorized access only), integrity (accuracy and completeness), availability (timely, reliable access).

Authentication factors: something you know, something you have, something you are; MFA requires two or more different factor types, not two instances of the same type.

Symmetric encryption uses one shared key and is fast; asymmetric encryption uses a public/private key pair and supports key exchange and digital signatures.

Hashing is a one-way function producing a fixed-length digest; it provides integrity, not confidentiality; a digital signature is a hash encrypted with the sender's private key.

Defense in depth layers controls so that failure of one layer does not expose the asset; least privilege and need-to-know limit access to the minimum required.

Common attack classes: phishing (social engineering), malware, denial of service, injection, man-in-the-middle, privilege escalation, supply chain compromise.

Vulnerability is a weakness; threat is a potential cause of harm; risk exists when a threat can exploit a vulnerability with an impact.

Patch management lifecycle: inventory, assess, prioritize by risk, test, deploy, verify; unpatched systems are a leading cause of breaches.

Data roles: controller determines purposes and means of processing; processor acts on the controller's instructions; data subject is the individual the data concerns.

GDPR lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests; consent must be freely given, specific, informed, and unambiguous.

Data subject rights include access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making.

Data protection principles: lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.

Personal data classification tiers: public, internal, confidential, restricted; handling rules (encryption, retention, sharing) attach to each tier.

Data lifecycle: collection, use, storage, sharing, retention, disposal; secure deletion must render data unrecoverable, not merely remove the directory entry.

Cross-border transfer mechanisms include adequacy decisions, standard contractual clauses, binding corporate rules, and explicit consent with disclosed risks.

A personal data breach must be notified to the supervisory authority without undue delay and where feasible within 72 hours of awareness under GDPR.

Incident response phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity (lessons learned).

Containment options: isolate the host, block the account, segment the network; choose based on evidence preservation versus operational impact.

Recovery Time Objective (RTO) is the maximum acceptable downtime; Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time.

Business Impact Analysis (BIA) identifies critical processes, dependencies, and maximum tolerable downtime; it feeds the business continuity plan.

Continuity strategies: hot site (near-immediate), warm site (partial readiness), cold site (space and power only), plus replication and failover.

Incident severity classification drives escalation, notification, and evidence-handling requirements; preserve volatile evidence first (memory, network state) before disk.

Crisis communication plan defines spokespeople, channels, and cadence; regulatory and customer notification timelines run in parallel with technical response.

Exercises: tabletop (discussion), functional (specific capability), full-scale simulation; after-action reports capture gaps and corrective actions.

Audit evidence types: inquiry, observation, inspection, reperformance, recalculation, analytical procedures, external confirmation; inspection and reperformance are generally stronger than inquiry.

Sampling: attribute sampling tests a rate of deviation for a control; variables sampling estimates a monetary amount; sample size rises with expected deviation rate and required confidence.

Control testing steps: walkthrough to confirm design, then test of operating effectiveness over a period; a design gap means the control cannot achieve the objective even if performed.

Findings structure: condition (what is), criteria (what should be), cause, effect/risk, recommendation; rate findings by impact and likelihood.

Materiality is the threshold above which an omission or misstatement could influence decisions; audit scope and depth are set relative to it.

Independence: the auditor must be free of conflicts of interest and must not audit work they performed or designed; self-review threat is a primary independence risk.

Audit report opinion types: unqualified, qualified, adverse, disclaimer; a scope limitation typically leads to a qualified opinion or disclaimer.

Follow-up verifies that management actions close the finding; a finding remains open until evidence demonstrates remediation.

Cloud service models: IaaS (provider supplies infrastructure), PaaS (platform/runtime), SaaS (application); shared responsibility shifts toward the provider as you move from IaaS to SaaS.

Cloud deployment models: public, private, hybrid, community; data residency and jurisdiction follow the physical location of storage and processing.

AI/ML governance: training data provenance and bias, model explainability, human oversight, model versioning, and monitoring for drift.

Generative AI risks include data leakage through prompts, hallucinated outputs, intellectual property exposure, and prompt injection; controls include data-loss prevention and output review.

Zero trust principles: never trust implicitly, verify explicitly, assume breach; enforce least privilege and continuous authentication rather than perimeter trust.

RPA and automation require control over bot credentials, change management, and exception handling; automated actions must be logged and attributable.

Digital transformation raises third-party and supply chain risk; due diligence, contractual security terms, and ongoing monitoring are core controls.

Blockchain properties: distributed ledger, immutability, consensus; confidentiality is not inherent, so sensitive data should be hashed or kept off-chain.

Core ethical principles for governance professionals: integrity, objectivity, confidentiality, competence, due care, and professional behavior.

Objectivity requires avoiding conflicts of interest and disclosing any relationship that could impair, or appear to impair, judgment.

Confidentiality persists after the engagement ends; disclosure is permitted only when required by law or authorized by the client/employer.

Reporting lines: internal audit reports functionally to the audit committee and administratively to senior management to preserve independence.

Stakeholder mapping: identify influence, interest, and impact; tailor message content, detail, and channel to each audience.

Findings communication should be factual, evidence-based, and free of blame; separate the observation from the recommendation.

Whistleblowing channels must allow confidential or anonymous reporting and be free from retaliation; retaliation is itself a governance failure.

When management disagrees with a finding, the auditor documents the disagreement and escalates through the governance structure rather than suppressing it.