Systems Auditor Examination study guide
Systems Auditor Examination · Work through your exam, one topic at a time.
The Certified Information Systems Auditor (CISA) credential is issued by ISACA and is described by the issuing body as the standard of achievement for auditing, monitoring and assessing IT and business systems. It is aimed at IT audit, assurance, control and security professionals who need to apply a risk-based approach to audit engagements, and ISACA states that it also addresses emerging technologies such as AI and blockchain. The Systems Auditor Examination study guide has 5 sections and about 2,076 words.
01Information Systems Auditing Process
Domain 1 covers the mechanics of an IS audit engagement: how the audit function is mandated, how engagements are planned and risk-ranked, how evidence is gathered and judged, and how findings are reported and followed up. Questions are scenario-based - you usually have to pick the next audit action or the most reliable evidence, not define a term.
413 words, about 2 min02Governance and Management of IT
Domain 2 asks whether IT is directed and controlled as a board-level responsibility: strategy alignment, organisational placement of IT, decision rights, policy architecture, performance measurement, risk appetite, and oversight of third parties. The auditor's question is always whether the structure gives the right people the right information at the right time.
411 words, about 2 min03Information Systems Acquisition, Development and Implementation
Domain 3 tests assurance over how systems are justified, built or bought, tested, migrated and handed over. The theme is that controls must be built in during the project, because retrofitting them after go-live is expensive and often skipped.
423 words, about 2 min04Information Systems Operations and Business Resilience
Domain 4 covers day-to-day delivery of IT services and the organisation's ability to keep them running through disruption: service management, change and configuration control, scheduling, backup, capacity, and disaster recovery/business continuity planning. Incident management restores service quickly; problem management finds and removes the root cause.
418 words, about 2 min05Protection of Information Assets
Domain 5 is the largest area: preserving confidentiality, integrity and availability of information across its lifecycle - classification, access control, authentication, cryptography, network and physical security, and incident response. Data classification drives handling rules, retention and access approval.
411 words, about 2 min