III IC-71 cheat sheet

IC-71 is an Institute of Chartered Accountants of India (ICAI) Information Systems Control and Audit (ISCA) elective-style paper code; confirm the exact syllabus edition and applicable study material date before relying on any single provision, since ICAI revises ISCA content periodically.

ISCA's four canonical knowledge areas: (1) Information Systems and their role in business, (2) Information Systems Control and Audit, (3) Information Technology Governance and Risk Management, (4) Protection of Information Systems and Business Continuity - each maps to a distinct question cluster.

Audit trail definition: chronological record of system activities sufficient to enable reconstruction, review, and examination of the sequence of events - the standard test is whether a transaction can be traced from source document to financial statement and back (audit trail completeness).

COSO Internal Control - Integrated Framework five components: Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring Activities; the 2013 revision adds 17 principles across these components.

COSO ERM (2017) replaces the 2004 cube with five components and 20 principles: Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, Information/Communication/Reporting - ERM is broader than internal control because it addresses strategy selection.

Segregation of duties rule: no single individual should control authorization, custody of assets, and recording (or reconciliation) of the same transaction - the classic test is combining any two of these three functions in one person.

Three lines model (IIA, 2020): first line = operational management owning risk; second line = risk and compliance functions providing expertise and challenge; third line = internal audit providing independent assurance to the governing body.

IT control classification: general IT controls (access management, change management, IT operations, backup) apply across systems; application controls (input, processing, output) apply to a specific business process and depend on effective general controls.

CAAT types: generalized audit software (e.g., data extraction and analysis tools), utility software, test data, and embedded audit modules; GAS is used for re-performance of calculations, stratification, duplicate detection, and gap detection on entire populations.

Audit sampling risk components: risk of incorrect acceptance (affects audit effectiveness) and risk of incorrect rejection (affects efficiency); detection risk falls as substantive procedures increase, per Audit Risk = Inherent Risk × Control Risk × Detection Risk.

Parallel simulation: auditor writes an independent program replicating the client's logic and compares outputs on the same input - tests processing accuracy without relying on client code, and can be run on live data.

Integrated Test Facility (ITF): dummy entities (e.g., a fictitious employee or vendor) are planted in the live system so transactions flow through production processing; requires subsequent reversal of the dummy entries and controls to prevent contamination of reported figures.

Change management control sequence: request → impact/risk assessment → authorization → development in a segregated environment → testing (unit, system, UAT) → approval → migration to production → post-implementation review; emergency changes require retroactive documentation and approval.

Evidence reliability hierarchy: auditor's direct physical observation and inspection > externally generated documents > internally generated documents with strong controls > oral representations; electronic evidence requires proof of integrity, completeness, and time-stamping.

Business continuity metrics: RTO = maximum tolerable downtime before resumption; RPO = maximum tolerable data loss measured in time; MTD = total time the process can be unavailable before unacceptable harm; RTO must be ≤ MTD.

IT governance frameworks: COBIT 2019 separates governance and management objectives and defines components (processes, structures, information, culture, people/skills, services); ISO/IEC 27001 covers ISMS requirements; ISO/IEC 27002 gives control implementation guidance.

Risk treatment options: avoid, reduce (mitigate), transfer (e.g., insurance, outsourcing with indemnity), and accept; residual risk is the risk remaining after controls and must be formally accepted by an accountable owner.

CIA triad: confidentiality (authorized disclosure only), integrity (accuracy and completeness, protection against unauthorized modification), availability (timely and reliable access); non-repudiation and authentication are supporting properties.

Encryption decision rules: symmetric (AES) is fast and used for bulk data but requires key distribution; asymmetric (RSA, ECC) solves key exchange and enables digital signatures; hashing (SHA-256) provides integrity only, not confidentiality.

Digital signature mechanics: hash the message → encrypt the hash with the sender's private key → recipient decrypts with sender's public key and recomputes the hash; provides integrity, authentication, and non-repudiation but not confidentiality.

Access control models: DAC (owner grants access), MAC (system-enforced labels, e.g., Bell-LaPadula no-read-up/no-write-down), RBAC (access by role), ABAC (attributes); least privilege and need-to-know are the governing principles.

Firewall placement: packet-filtering at network perimeter; stateful inspection tracks connection state; application-layer proxy inspects payload; DMZ hosts externally reachable services between two firewall tiers; IDS detects and alerts, IPS detects and blocks inline.

Backup strategy rules: full backup resets the archive bit; incremental backs up changed files since the last backup of any type (fastest backup, slowest restore); differential backs up changes since the last full backup (restore needs full plus latest differential).

Disaster recovery site types: hot site (near-zero RTO, highest cost, fully mirrored), warm site (partial equipment, hours to days), cold site (space and power only, days to weeks); mirroring and replication support near-zero RPO.

Answer structure for scenario questions: identify the risk or control weakness → cite the applicable principle or standard → state the specific control or procedure → state the evidence the auditor would obtain; marks are awarded per distinct technical point.

Distinguish control objective from control procedure: the objective states what must be achieved (e.g., all valid transactions are recorded once); the procedure states how (e.g., three-way match of purchase order, goods receipt, and invoice before payment).

When a question asks for audit procedures, phrase each as an action the auditor performs and the evidence produced; avoid restating the client's control as if it were the auditor's test.

Commonly confused pairs to keep separate: preventive vs detective controls; general vs application controls; governance vs management; risk assessment vs risk treatment; RTO vs RPO; hot vs cold site.

Materiality and IT: a control deficiency is significant if it could result in a misstatement that is more than inconclusive; report deficiencies in writing to those charged with governance, and communicate significant deficiencies to management on a timely basis.

Outsourcing/third-party considerations: obtain SOC 1 (financial reporting controls) or SOC 2 (trust services criteria) reports, review the complementary user entity controls, and assess the carve-out vs inclusive method before relying on the service organization's controls.

Cyber incident response phases: preparation → detection and analysis → containment, eradication, recovery → post-incident lessons learned; preservation of evidence must precede eradication to retain forensic admissibility.

Data protection duties commonly tested: lawful basis and purpose limitation, data minimization, retention limits, breach notification timelines, and cross-border transfer restrictions; map each duty to a specific control rather than a general statement.