Systems Auditor Examination study plan

Map the full IS operations lifecycle (job scheduling, batch vs. online processing, output handling, problem/incident management) and write a one-page flow you can redraw from memory

Distinguish the components of IT service management (incident, problem, change, configuration, release) and state for each what evidence an auditor would collect

Explain capacity planning, performance monitoring, and the difference between preventive and predictive maintenance in your own words

Identify the control objectives behind segregation of duties in operations (scheduling, operations, output distribution) and give one concrete failure scenario for each

Differentiate availability, reliability, and resilience, and apply RTO, RPO, MTD, and MTBF to three short scenarios

Compare hot, warm, and cold recovery sites plus mirrored and redundant configurations, and justify a site choice for a stated budget and outage tolerance

Sequence the contents of a business continuity plan and a disaster recovery plan and explain how testing types (tabletop, simulation, full failover) escalate in assurance value

Analyze backup rotation schemes and retention design, including offsite and immutable copies, against ransomware-style threats

Classify information assets by sensitivity and map each class to handling requirements for storage, transmission, and disposal

Explain symmetric vs. asymmetric cryptography, hashing, digital signatures, and PKI in terms of what each does and does not guarantee

Match physical and environmental controls (access, surveillance, fire suppression, humidity, power conditioning) to the threats they address

Describe logical access controls from identification through authorization, including authentication factors and the risks of single sign-on

Design network segmentation and perimeter controls (firewalls, DMZ, IDS/IPS, proxies) and explain where each sits in a layered defense

Evaluate identity and access management practices, including privileged access, recertification, and the audit trail needed to test them

Draft audit programs for two asset-protection areas, specifying population, sampling approach, test procedure, and evidence for each step

Identify data classification, privacy, and data-leakage risks and the detective controls that would surface them

Apply the audit planning sequence: understand the business, define scope and objectives, assess risk, and select the audit approach

Select and justify sampling methods for attribute and variable testing, and compute a defensible sample size for a stated confidence and tolerable error rate

Distinguish evidence types and rank them by reliability, then explain how to document workpapers so a reviewer can reperform the test

Frame findings and recommendations so they state condition, criteria, cause, effect, and a risk-ranked recommendation

Describe follow-up and reporting mechanics, including how management responses and residual risk are tracked to closure

Map IT governance structures and accountability (board, steering committee, CIO/CISO roles) and explain how they interact with enterprise risk management

Compare control frameworks and standards at a conceptual level and state when an auditor would reference each

Translate IT strategy into measurable performance indicators and explain how balanced scorecards and maturity models are used to monitor IT

Outline IT policy hierarchy from policy to standard to procedure and identify the control gaps that appear when the hierarchy is incomplete

Explain outsourcing and third-party risk management, including due diligence, contract controls, and ongoing monitoring

Compare development methodologies (waterfall, iterative, agile) and identify the control points an auditor tests in each, including how requirements traceability changes

Explain the SDLC phase gates and the specific risks of skipping requirements, design review, or testing phases

Describe change and configuration management controls for both in-house and packaged implementations, and state the evidence each leaves

Identify application control categories (input, processing, output) and design a test for one of each

Explain how data migration, conversion, and post-implementation review are validated before sign-off

Recompute your weakest areas from a full-length timed practice set and rank the five domains by score gap

Re-derive the highest-yield formulas and frameworks (RTO/RPO, sampling, recovery sites, control categories) from memory without notes

Rewrite your three weakest audit programs or checklists so each step is testable and evidence-linked

Build a one-page pre-exam sheet limited to items you have personally gotten wrong, and rehearse explaining each aloud in under a minute