Systems Auditor Examination case studies
Systems Auditor Examination · Put your knowledge to work in context.
The Certified Information Systems Auditor (CISA) credential is issued by ISACA and is described by the issuing body as the standard of achievement for auditing, monitoring and assessing IT and business systems. It is aimed at IT audit, assurance, control and security professionals who need to apply a risk-based approach to audit engagements, and ISACA states that it also addresses emerging technologies such as AI and blockchain. The Systems Auditor Examination case studies are 5 cases and about 5,354 words.
1Three Deviations in a Change-Management Sample: Reliance, Extrapolation, and the Deadline Squeeze
During the planning phase of an integrated audit of Meridian Logistics, the IS auditor selects 60 change tickets from a population of 1,240 production changes executed in the last year, using a random sample with a 5% tolerable deviation rate and a 10% expected rate. Testing finds 3 changes lacking documented business approval, all on the same weekend, all related to a single vendor patch bundle.
1,322 words, about 7 min2Federated IT in a 14-Unit Group: Framing a Governance Opinion Before the CFO Has Decided the Answer
At Harlow Group, a diversified manufacturer with 14 business units and revenue of EUR 3.1 billion, IT spend is 6.4% of revenue against a peer median of 3.9%. Each unit selects, contracts, and operates its own ERP, CRM, and payroll platforms; the group CIO has 22 staff and no budget authority over the units.
959 words, about 5 min3Warehouse System Go-Live With 21 Days Left: Conditions, Escalation, and the Expiring Licence
Northwind Retail is scheduled to go live with a new warehouse management system across 6 distribution centres in 21 days. At the go-live readiness review: 47 open defects, of which 6 are severity 1, including a carton-label print failure that staff work around by reprinting at a supervisor station; 18 are severity 2.
1,027 words, about 5 min4DR Test Misses RTO by Seven Hours: Severity, Priorities, and the 'It Has Never Happened' Argument
During a disaster recovery test, Caldwell Health's tier-1 patient scheduling system, with a stated RTO of 4 hours and RPO of 15 minutes, was restored at a secondary site in 11 hours 20 minutes. The test revealed that the most recent full backup was 26 hours old, two of five tapes in the restore set failed checksum validation, the runbook referenced a database version decommissioned 8 months earlier, and the DR coordinator's contact list was last updated 3 years ago.
1,024 words, about 5 min5Privileged Access at a 4,200-User Bank: Nine Orphan Admins, a PAM Bypass, and a 99.6% Approval Rate
An auditor reviews identity and access management at a bank with 4,200 employees. Findings: 38 accounts hold domain administrator rights against a design baseline of 6; 9 of these belong to users terminated between 2 and 11 months ago; the privileged access management vault is deployed but 62% of privileged accounts are excluded through a legacy break-glass group whose membership is never reviewed; database administrator sessions on the core banking platform are not logged; the data loss prevention tool generates about 4,100 alerts per month, triaged by 2 analysts, and 78% are closed as expected business activity without a documented reason.
1,022 words, about 5 min