Domain 1: Information System Auditing Process

CISA · about 18% of the exam

How an IS audit is planned, executed and reported, from standards and ethics to sampling, evidence and follow-up.

Standards and ethics

ISACA Code of Professional Ethics The seven principles every CISA holder signs up to, what each one means in everyday audit work, and how the exam turns them into 'what should the auditor do?' questions.
ITAF: The Standards Framework ISACA's rulebook for IS auditors: what's mandatory, what's guidance, and the handful of standards the exam turns into scenarios.
Standards vs. Guidelines vs. Tools A short one: which of ISACA's documents you must follow, which you should follow, and which are just there to help.
Auditor Independence and Objectivity Why an auditor's opinion is only worth something if they're free from influence, the difference between independence and objectivity, and what to do when either is at risk.

Audit Charter: Purpose and Contents The document that gives the audit function its authority: what it contains, who approves it, and how it differs from an engagement letter.
Audit Testing: Compliance vs. Substantive The two kinds of audit test: checking that controls work, and checking that the data itself is right. How one decides how much of the other you need.
Financial vs. Operational vs. Integrated Audits The kinds of audit the exam names, the question each one answers, and how to tell from a scenario which one is being described.
Forensic and Specialized Audits What changes when an audit might end up in court, what an auditor should (and shouldn't) do on finding fraud, and how to rely on a service provider's SOC report.

Risk-Based Audit Approach Why auditors spend their limited time where things are most likely to go badly wrong, the steps of a risk-based audit, and the 'what should the auditor do FIRST?' questions.
Inherent, Control, Detection, and Audit Risk Why an auditor can still get it wrong, the three things that cause it, and how the auditor decides how hard to look. Explained with a simple 'nets' picture.
Audit Universe and Annual Audit Plan How audit decides what to look at each year: list everything that could be audited, rank it by risk, and build a plan the audit committee approves.
Audit Objectives, Scope, and the Audit Program Planning a single audit: deciding what it must conclude, where its boundaries are, and the step-by-step tests in the audit program. Plus what to do when someone blocks the scope.

Types and Reliability of Audit Evidence What counts as good audit evidence, why some evidence is more trustworthy than others, and how to pick the 'most reliable' answer on the exam.
Sampling: Statistical vs. Non-Statistical Why auditors test a sample instead of everything, statistical versus judgement sampling, attribute versus variable sampling, and the selection methods the exam names.
Sampling Terms: Confidence Level, Tolerable Error and Friends The sampling vocabulary in plain words, and the exam favourite: which changes make the sample bigger or smaller.
Interviews, Observation, and Walkthroughs How auditors learn how things really work: asking, watching, and following one transaction through. What each one proves, and what it doesn't.
CAATs and Data Analytics Using computers to audit computers: audit software, test data, integrated test facilities and parallel simulation, explained simply, with when each one fits.
Continuous Auditing and Monitoring Moving from once-a-year checks to near real-time assurance: the difference between monitoring and auditing, and the online audit techniques (audit hooks, snapshots, SCARF, ITF, CIS).

Preventive, Detective, Corrective Controls Sorting controls by what they do (put off, block, spot, fix), why prevention usually wins, and how the exam asks you to pick the best control.
General vs. Application Controls The two layers of IT controls: general controls that protect the whole IT environment, and application controls inside individual systems. Why the first must be tested before the second can be trusted.
Compensating Controls and Segregation of Duties Why one person shouldn't control a whole process, the four duties to keep apart, how auditors test it, and what to do when a team is too small to split the work.

Materiality and Evaluating Findings Deciding what's important enough to matter: why IS materiality is mostly about impact rather than money, why small findings can add up, and how a good finding is written.
Audit Report Structure and Communication What goes in an audit report, how findings are agreed with management before it's issued, and what happens when management disagrees or has already fixed the problem.
Follow-Up and Management Action Plans After the report: who fixes the problems, how audit checks they're really fixed, and what happens when management decides to live with the risk instead.
Control Self-Assessment (CSA) Getting the people who run a process to assess its risks and controls themselves, with the auditor as facilitator. What it's for, its benefits, and the risk of mistaking it for an audit.
Audit Quality and Using Other Experts' Work How the audit function makes sure its own work is good, and what an auditor must check before relying on someone else's work.