SIDC Module 18 cheat sheet

The single listed domain is recorded as unverified because Module 18's content outline was not present in the retrieved source; any mapping of topics to this domain is provisional and must be flagged for review.

A defensible study plan for an unverified domain starts from the exam's published syllabus and weighting table, not from third-party summaries, because only the syllabus is authoritative for scope.

Terminology drift is the main risk in unverified modules: the same acronym can carry different meanings across modules, so each term should be pinned to the definition used in the module's own objectives.

When a domain's scope is unknown, classify candidate topics as in-scope (named in the syllabus), adjacent (implied by a named topic), or out-of-scope (neither), and weight revision effort in that order.

Cross-module dependencies should be listed explicitly: a topic in an unverified module is often a prerequisite for, or application of, a topic in a verified module.

Any factual claim used to build study material should carry a source anchor (document title and section) so it can be re-checked when the official outline is published.

A null value in a knowledge record means the fact was not confirmed with confidence; it is a placeholder for review, never a statement that the fact is false.

Review triggers for unverified content: publication of the official outline, a change in exam weighting, or a corrected source that contradicts a previously recorded fact.

Three-line defence model: first line owns and manages risk in the business, second line sets frameworks and monitors, third line (internal audit) provides independent assurance; the model separates ownership from assurance.

Risk is commonly scored as likelihood × impact; a 5×5 matrix yields scores from 1 to 25, and tolerance thresholds determine whether a score is accepted, treated, transferred, or avoided.

Inherent risk is the exposure before controls; residual risk is the exposure after controls; control effectiveness is the gap between the two, not the residual score alone.

Control types: preventive (stops an event), detective (identifies an event after it occurs), corrective (restores service), and directive (specifies required behaviour); a single risk usually needs more than one type.

Segregation of duties is a preventive control that requires no single person to initiate, approve, record, and reconcile the same transaction; compensating controls are needed where headcount prevents full separation.

Key risk indicators are leading metrics with defined thresholds and owners; key performance indicators measure outcomes, and a KRI without a threshold and an escalation path is not actionable.

Evidence standards: an audit finding needs criteria, condition, cause, effect, and a recommendation; a finding without a testable criterion is an opinion.

Exception and waiver records must state the risk accepted, the approver, the expiry date, and the compensating control, otherwise the exception becomes a permanent undocumented exposure.

Evidence hierarchy for assurance work: system-generated logs and records outrank screenshots, screenshots outrank verbal confirmation, and verbal confirmation should be corroborated before it is relied on.

Sampling logic: attribute sampling tests whether a control operated (yes/no per item); variables sampling estimates a value; sample size rises with required confidence and falls with tolerable deviation rate.

Chain of custody requires who collected the evidence, when, from which system, by what method, and where it is stored; a break in the chain weakens the evidential weight.

Data minimisation: collect only fields needed for the stated purpose, record the lawful basis, and set a retention period with a deletion trigger at the point of collection.

Reproducibility test: a second person with the same inputs and the documented method should reach the same result; if not, the method is underspecified.

Version control for documents means a unique identifier, an author, a reviewer, an approval date, and a change log; an undated document cannot be shown to be current.

Rounding and units must be stated in any quantitative record (currency, percentage points versus percent change) because unit ambiguity is a common source of restated findings.

A register entry is complete only when it names an owner, a due date, a status, and a linked piece of evidence; missing any one of these makes follow-up untestable.

Question stems that say BEST, MOST likely, or FIRST are testing prioritisation: eliminate options that are true but not the highest-priority action in the stated sequence.

When two options are both correct in general, the discriminator is usually scope (does it address the stated risk?) or sequence (does it precede the other step?).

Quantitative items should be answered by writing the formula before substituting numbers, so that a unit or order-of-magnitude error is visible.

Distractor patterns to check: a control described as detective when it is preventive, a risk treatment described as transfer when it is avoidance, and a metric described as leading when it is lagging.

Time allocation follows item weighting: if a domain carries a stated percentage of the exam, the revision and in-exam time should be split in roughly that proportion.

Flag-and-return is the correct handling for items that depend on a fact recorded as unverified, because guessing consumes time that verified items would use better.

Answer review step: confirm the selected option answers the exact question asked (for example, which control type, not which control objective).