Systems Auditor Examination cheat sheet

Audit risk = inherent risk × control risk × detection risk; the auditor controls only detection risk, so higher reliance on substantive testing lowers detection risk and raises audit effort.

Risk-based auditing prioritizes the areas of highest residual risk (inherent × control) so that scarce audit resources target the greatest exposure.

Audit evidence is ranked by reliability: auditor's own observation and inspection > externally sourced documents > internally generated documents > oral representations from management.

Sampling: attribute sampling tests a rate of deviation (compliance); variables sampling estimates a monetary amount (substantive); stop-or-go and discovery sampling are attribute variants.

Sampling risk is the risk that the sample is not representative; non-sampling risk covers human error, wrong procedures, and misinterpretation, and is reduced by good planning and supervision.

Materiality is set at planning and drives the nature, timing, and extent of procedures; lower materiality thresholds increase sample sizes.

The audit trail must let an auditor reconstruct each transaction from origination to financial reporting; missing trails are a reportable control deficiency.

ISACA audit standards and guidelines require that audit objectives, scope, and criteria be documented in an engagement letter before fieldwork begins.

A finding is written as condition, criteria, cause, effect, and recommendation; the recommendation is the only element the auditor proposes as a change.

IT governance is the responsibility of the board and executive management; it sets direction, monitors performance, and ensures IT sustains and extends enterprise strategy.

COSO has five components (control environment, risk assessment, control activities, information and communication, monitoring) and 17 principles; COBIT is the IT-specific framework that operationalizes them.

COBIT separates governance from management: governance domains are EDM (evaluate, direct, monitor); management domains are APO, BAI, DSS, and MEA.

Segregation of duties requires that no single person can initiate, authorize, record, and reconcile a transaction; conflicting duties include custody of assets versus recordkeeping.

The three lines model: management owns controls (first line), risk and compliance functions monitor (second), internal audit provides independent assurance (third).

A key performance indicator measures achievement of a goal; a key risk indicator signals rising exposure; key goal indicators measure whether IT delivered business value.

An IT steering committee with business and IT representation prioritizes projects, allocates resources, and resolves conflicts; it is a governance control, not a technical one.

Policies are mandatory management intent; standards are specific mandatory requirements; procedures are step-by-step instructions; guidelines are recommended, non-mandatory practices.

SDLC phases: feasibility/requirements, design, development, testing, implementation, post-implementation review; the auditor should be involved from requirements onward, not only at go-live.

The business case must include measurable benefits, costs, risks, and alternatives; approval by the steering committee and business owner precedes funding.

Testing hierarchy: unit (developer), integration (interfaces), system (end-to-end), UAT (business users), regression (no broken existing function), and parallel or pilot conversion before cutover.

Segregation in development: developers must not have production access; migration of code to production is performed by an independent party using approved change tickets.

Change management controls: documented request, impact and risk assessment, approval by an authorized owner, testing evidence, backout plan, and post-implementation verification.

Data conversion risks are completeness, accuracy, and reconciliation of opening balances; totals must be reconciled from legacy to new system and signed off.

Agile delivery shifts control emphasis to sprint reviews, definition of done, automated testing, and continuous backlog prioritization; audit evidence becomes sprint artifacts and CI/CD logs.

A post-implementation review (PIR) verifies that promised benefits were realized and identifies lessons learned; absence of a PIR is a project governance gap.

Recovery metrics: RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss measured in time; MTD is the point of unacceptable business impact.

Backup generations follow the grandfather-father-son rotation; a full backup plus incremental (since last backup) or differential (since last full) sets the restore chain.

The restore test, not the backup job, is the control that proves recoverability; untested backups are unverified assumptions.

A hot site is fully equipped and near-immediate; warm site is partially equipped; cold site provides space and power only; mirrored sites provide zero or near-zero data loss.

Capacity and performance monitoring uses thresholds and trend analysis; a baseline compared to current utilization identifies degradation before service impact.

Job scheduling controls include authorization of schedule changes, exception reporting for abended jobs, and review of console logs; unmonitored failed jobs can corrupt downstream data.

Incident management follows detection, classification, containment, eradication, recovery, and lessons learned; problem management addresses root cause.

BCP addresses business processes and people; DRP addresses technology recovery; both must be tested at least annually with results reported to management.

The CIA triad: confidentiality (authorized disclosure only), integrity (accuracy and completeness), availability (timely access); controls are classified as preventive, detective, or corrective.

Access control models: DAC (owner discretion), MAC (labels and clearance), RBAC (role-based, least privilege), ABAC (attributes and policy).

Authentication factors: something you know, have, or are; multi-factor authentication requires at least two different factor types, not two instances of the same type.

Encryption: symmetric (AES) is fast and used for bulk data but requires key distribution; asymmetric (RSA, ECC) solves key exchange and enables digital signatures.

A digital signature provides integrity, authentication, and non-repudiation but not confidentiality; a hash alone provides integrity only.

PKI trust: a certificate binds a public key to an identity and is validated by checking the chain to a trusted root CA, validity dates, and revocation status (CRL or OCSP).

Defense in depth layers controls across network (firewalls, segmentation), host (hardening, EDR), application (input validation, secure coding), and data (encryption, DLP).

Physical controls include perimeter barriers, badge access with anti-passback, CCTV, environmental sensors, and visitor escorts; logical controls never compensate for an unsecured facility.