Certified Information Systems Auditor (CISA) Exam Guide

1. 1APlanning
2. 1A1IS Audit Standards, Guidelines, Functions, and Codes of Ethics
3. 1A2Types of Audits, Assessments, and Reviews
4. 1A3Risk-Based Audit Planning
5. 1A4Types of Controls and Considerations
6. 1BExecution
7. 1B1Audit Project Management
8. 1B2Audit Testing and Sampling Methodology
9. 1B3Audit Evidence Collection Techniques
10. 1B4Audit Data Analytics (including audit algorithms)
11. 1B5Reporting and Communication Techniques
12. 1B6Quality Assurance and Improvement of Audit Process

Example scenario: You have two weeks to audit a payroll system with a recent history of manual overrides. Where would you focus testing, and what evidence would you collect?

1. 2AIT Governance
2. 2A1Laws, Regulations, and Industry Standards
3. 2A2Organizational Structure, IT Governance, and IT Strategy
4. 2A3IT Policies, Standards, Procedures and Practices
5. 2A4Enterprise Architecture (EA) and Considerations
6. 2A5Enterprise Risk Management (ERM)
7. 2A6Privacy Program and Principles
8. 2A7Data Governance and Classification
9. 2BIT Management
10. 2B1IT Resource Management
11. 2B2IT Vendor Management
12. 2B3IT Performance Monitoring and Reporting
13. 2B4Quality Assurance and Quality Management of IT

Example scenario: A business unit signs a cloud contract without involving IT or security. Which governance controls failed, and what would you report?

1. 3AInformation Systems Acquisition and Development
2. 3A1Project Governance and Management
3. 3A2Business Case and Feasibility Analysis
4. 3A3System Development Methodologies
5. 3A4Control Identification and Design
6. 3BInformation Systems Implementation
7. 3B1System Readiness and Implementation Testing
8. 3B2Implementation Configuration and Release Management
9. 3B3System Migration, Infrastructure Deployment, and Data Conversion
10. 3B4Post-Implementation Review

Example scenario: A new ERP goes live with data migrated from three legacy systems. What would you check to confirm the converted data is complete and accurate?

1. 4AInformation Systems Operations
2. 4A1IT Components
3. 4A2IT Asset Management
4. 4A3Job Scheduling and Production Process Automation
5. 4A4System Interfaces
6. 4A5Shadow IT and End-User Computing (EUC)
7. 4A6Systems Availability and Capacity Management
8. 4A7Problem and Incident Management
9. 4A8IT Change, Configuration, and Patch Management
10. 4A9Operational Log Management
11. 4A10IT Service Level Management
12. 4A11Database Management
13. 4BBusiness Resilience
14. 4B1Business Impact Analysis (BIA)
15. 4B2System and Operational Resilience
16. 4B3Data Backup, Storage, and Restoration
17. 4B4Business Continuity Plan (BCP)
18. 4B5Disaster Recovery Plans (DRP)

Example scenario: A disaster recovery test met its recovery time but skipped restoring the main database. How would you assess and report the result?

1. 5AInformation Asset Security and Control
2. 5A1Information Asset Security Policies, Frameworks, Standards, and Guidelines
3. 5A2Physical and Environmental Controls
4. 5A3Identity and Access Management
5. 5A4Network and End-Point Security
6. 5A5Data Loss Prevention (DLP)
7. 5A6Data Encryption
8. 5A7Public Key Infrastructure (PKI)
9. 5A8Cloud and Virtualized Environments
10. 5A9Mobile, Wireless, and Internet-of-Things (IoT) Devices
11. 5BSecurity Event Management
12. 5B1Security Awareness Training and Programs
13. 5B2Information System Attack Methods and Techniques
14. 5B3Security Testing Tools and Techniques
15. 5B4Security Monitoring Logs, Tools, and Techniques
16. 5B5Security Incident Response Management
17. 5B6Evidence Collection and Forensics

Example scenario: Terminated employees still have active accounts in a finance application. What would you test to find the root cause?