ISACA CISA Review Manual - Chapter 1: Information System Auditing Process & Overview

CISA Exam Specifications and Job Practice Structure

• Certification Background and Accreditation:

  • The Certified Information Systems Auditor (CISA) credential is administered by ISACA, a global association established in 1969 that serves over 460,000 engaged professionals, including 140,000 members across 188 countries and over 220 local chapters.

  • The CISA certification program is officially accredited under ISO/IEC 17024:2012 (General Requirements for Bodies Operating Certification Systems of Persons) by the American National Standards Institute (ANSI).

  • Certification candidates are required to pass a comprehensive four-hour examination consisting of 150 multiple-choice questions designed to test experiential knowledge and technical competence.

  • Scoring is calculated on a common scaled basis ranging from $200$ to $800$ points, where a scaled score of $450$ represents the minimum passing threshold established by the CISA Certification Working Group.

  • A minimum of five years of verified professional experience in information systems auditing, control, assurance, or security is required for full certification, with experience earned within the 10-year period preceding application or within five years of passing the examination.

• CISA Job Practice Domain Weightings (Updated for 2019):

  • Domain 1: Information System Auditing Process — represents $21\%$ of the examination (approximately 32 questions).

  • Domain 2: Governance and Management of IT — represents $17\%$ of the examination (approximately 26 questions, increased from $16\%$ in prior practice).

  • Domain 3: Information Systems Acquisition, Development, and Implementation — represents $12\%$ of the examination (approximately 18 questions, decreased from $18\%$ in prior practice).

  • Domain 4: Information Systems Operations and Business Resilience — represents $23\%$ of the examination (approximately 34 questions, increased from $20\%$ in prior practice).

  • Domain 5: Protection of Information Assets — represents $27\%$ of the examination (approximately 41 questions, increased from $25\%$ in prior practice).

Domain 1: Information System Auditing Process — Planning, Standards, and Governance

• Audit Definition and Objectives:

  • An information systems (IS) audit is a formal examination and evaluation of an organization's IT infrastructure, applications, data use, and operational processes.

  • Primary audit objectives verify that systems comply with applicable laws, regulations, and contractual obligations; adhere to governance criteria, policies, and procedural standards; safeguard asset confidentiality, integrity, and availability (CIA); and execute operations efficiently while meeting effectiveness targets.

• ISACA IS Audit and Assurance Framework (ITAF):

  • General Standards: Mandatory guiding principles governing ethical conduct, independence, objectivity, professional due care, knowledge, competency, and professional skill sets.

  • Performance Standards: Mandatory requirements concerning the operational conduct of engagements, covering planning, scoping, risk analysis, materiality thresholds, resource allocation, supervisory review, and evidentiary validation.

  • Reporting Standards: Mandatory stipulations specifying report structures, communication methods, qualification disclosures, and overall conclusion presentation.

  • Guidelines and Tools: Guidelines provide nonmandatory, authoritative implementation guidance requiring professional judgment; departure from guidelines must be justifiable. Tools and techniques provide practical methodological examples.

• The Audit Charter and Mandate:

  • The audit charter is an overarching executive document formally approved by the board of directors and the audit committee.

  • Establishes the clear mandate, purpose, authority, operational scope, and official delegation of accountability of the internal audit function.

  • The audit charter can only be modified through thorough justification and formal board-level re-approval.

  • Individual client engagements that originate from the overarching charter are governed by specific engagement letters or statements of work (SOW).

• Audit Project Planning and Execution Life Cycle:

  • Figure 1.1 illustrates the linear flow of the typical three-phase audit life cycle:

• Audit Universe: An exhaustive repository compiling every auditable business process, technical service, and organizational unit within an enterprise.

• Risk Assessment for Annual Planning:

  • High Risk: Potential damage requiring greater than $6$ months to recover.

  • Medium Risk: Potential damage requiring between $3$ and $6$ months to recover.

  • Low Risk: Potential damage requiring less than $3$ months to recover.

• Figure 1.2 procedural steps for individual engagement planning:

  • Step 1: Gain an understanding of organizational mission, purpose, objectives, and operational processes.

  • Step 2: Understand the organization's governance structures and operational practices.

  • Step 3: Identify recent environmental, operational, and architectural changes.

  • Step 4: Review prior working papers and previous findings.

  • Step 5: Document relevant policies, standards, guidelines, and structural hierarchies.

  • Step 6: Perform formal risk analysis to frame the audit plan.

  • Step 7: Define the audit scope and articulate explicit audit objectives.

  • Step 8: Formulate the detailed audit approach and strategy.

  • Step 9: Allocate qualified personnel resources.

  • Step 10: Finalize logistical and administrative arrangements.

Domain 1: Information System Auditing Process — Business Applications and Emerging Architectures

• Ecommerce Architectures and Operational Models:

  • Transactional classifications include Business-to-Business (B2B), Business-to-Consumer (B2C), Consumer-to-Consumer (C2C), Consumer-to-Business (C2B), Business-to-Government (B2G), and Consumer-to-Government (C2G).

  • Architectural Tiers:

  • Single-tier: Monolithic client application executing locally on a single machine.

  • Two-tier: Client system communicating directly with a centralized database engine.

  • Three-tier: Presentation tier (web browser/GUI), Application/Business Logic tier (application server executing code components), and Data tier (relational databases and file storage).

  • Extensible Markup Language (XML) and modern middleware support loose coupling via Web Services:

  • Simple Object Access Protocol (SOAP): XML-based messaging protocol transmitting across port $80$ (HTTP) or port $443$ (HTTPS).

  • Web Services Description Language (WSDL): XML formatting describing network service interface endpoints.

  • Universal Description, Discovery, and Integration (UDDI): Distributed directory services publishing registered web services.

• Electronic Data Interchange (EDI):

  • Traditional EDI relies on proprietary value-added networks (VANs), which function as secure, store-and-forward electronic post offices providing transmission audit trails, mailbox services, and transaction routing.

  • Web-based EDI operates over open Internet standards via Internet service providers (ISPs), reducing telecommunication costs but requiring rigorous application-level encryption.

  • Core EDI Architectural Components:

  • Communications Handler: Manages transmission lines and network protocol handshakes.

  • EDI Interface: Combines an EDI Translator (converting data between public formats like ANSI X12 or EDIFACT and internal formats) with an Application Interface (mapping data fields to internal applications).

  • Application System: The back-end enterprise software processing business transactions.

• Industrial Control Systems (ICS):

  • Supervisory Control and Data Acquisition (SCADA), Distributed Control Systems (DCS), and Programmable Logic Controllers (PLC) monitor physical, chemical, and manufacturing operations.

  • Figure 1.3 outlines the architectural flow of modern ICS deployments:

• ICS security requires physical segregation, segmented demilitarized zones (DMZs), strict firewalls blocking corporate traffic from direct plant-floor transmission, and fail-safe designs to prevent cascading physical failures.

  • Artificial Intelligence and Expert Systems:

• Expert systems automate rule-based decision-making through dedicated software shells.

• Figure 1.4 details the functional structural layout of an expert system:

• Inference Engine: Executes logical analysis using rules stored in the Knowledge Base (KB).

• Knowledge Base Formats: Formulated via decision trees (deterministic questionnaire sequences), rule sets ($\text{IF}-\text{THEN}$ declarative relationships), or semantic networks (graph nodes showing conceptual linkages).

• Explanation Module: Details the rationale behind decisions for users and audit trails.

Domain 1: Information System Auditing Process — Control Types, Risk-Based Auditing, and Analytics

• Control Classifications and Implementation:

  • Figure 1.5 categorizes operational controls:

  • Preventive Controls: Intercept errors or malicious activities prior to execution. Examples include segregation of duties (SoD), transaction authorization limits, biometric physical access locks, preprogrammed input edits, and encryption.

  • Detective Controls: Discover and report occurrences of adverse events, errors, or unauthorized actions. Examples include hash totals, automated batch balancing, log reviews, secure code reviews, and variance analysis.

  • Corrective Controls: Mitigate the impact of an event, remediate errors discovered by detective mechanisms, and restore normal processing. Examples include business continuity plans (BCP), disaster recovery plans (DRP), system backups, and server fail-over clusters.

  • Compensating vs. Overlapping Controls:

  • Compensating Control: An alternate internal control designed to minimize the risk of a discovered weakness when primary controls (such as strict SoD) cannot be implemented.

  • Overlapping Controls: Two or more independent, strong controls operating concurrently to protect a single process (e.g., electronic card-key access paired with a physical security guard).

• The Risk-Based Audit Methodology:

  • Figure 1.6 models the five sequential phases of the risk-based audit approach:

• Mathematical Risk Equation:

$\text{Overall Audit Risk} = \text{Inherent Risk} \times \text{Control Risk} \times \text{Detection Risk}$

• Audit Risk Components:

  • Inherent Risk ($\text{IR}$): The baseline vulnerability of an assertion or process assuming an absence of internal compensating controls.

  • Control Risk ($\text{CR}$): The probability that internal control structures fail to prevent or detect material errors in a timely manner.

  • Detection Risk ($\text{DR}$): The risk that audit substantive procedures fail to identify existing material misstatements. Composed of sampling risk and nonsampling risk.

• Figure 1.7 highlights the NIST SP 800-30 risk assessment workflow:

• Figure 1.8 highlights the continuous enterprise risk management cycle:

• Audit Testing and Sampling Techniques:

  • Compliance Testing (Tests of Controls): Determines whether management control procedures operate effectively in compliance with stated policies.

  • Substantive Testing (Tests of Details): Direct verification of the integrity, validity, and accuracy of transaction balances and reporting records.

  • Figure 1.11 illustrates testing alignment:

• Figure 1.12 details the sample selection phases:

• Statistical Sampling Models:

  • Attribute Sampling: Measures rate of occurrence of a specific attribute (e.g., authorization signatures). Includes Fixed Sample-Size, Stop-or-Go (minimizing samples when few errors are expected), and Discovery Sampling (used when discovering a single deviation indicates fraud).

  • Variable Sampling: Measures quantitative values, dollar amounts, or physical weights. Includes Stratified Mean-per-Unit, Unstratified Mean-per-Unit, and Difference Estimation.

• Key Statistical Metrics:

$\text{Level of Risk} = 1 - \text{Confidence Coefficient}$

* Precision represents the acceptable range of variance between the sample and the population.
* Tolerable Error Rate represents the planned upper limit of errors before a population is deemed materially misstated.

• Continuous Online Auditing and CAATs:

  • Computer-Assisted Audit Techniques (CAATs) include Generalized Audit Software (GAS), utility tools, automated scripts, and continuous monitors.

  • Figure 1.13 evaluates continuous audit techniques:

* Systems Control Audit Review File / Embedded Audit Modules (SCARF/EAM): High complexity; embedded code selects live transactions for review without operational interruption.
* Snapshots: Medium complexity; captures electronic pictures of transaction logic paths.
* Audit Hooks: Low complexity; software red flags alerting auditors to questionable conditions.
* Integrated Test Facility (ITF): High complexity; processes fictitious test transactions alongside live production data into dummy accounts.
* Continuous and Intermittent Simulation (CIS): Simulates program execution during processing runs to audit transactions matching specific parameters.

• Control Self-Assessment (CSA) and Integrated Auditing:

  • CSA empowers line managers and staff to review their operational controls, shifting primary monitoring to business units while the auditor acts as a facilitator.

  • Figure 1.14 illustrates the intersection of Financial, Operational, and IS Audits:

Domain 2: Governance and Management of IT — Enterprise Governance, Frameworks, and Strategy

• Enterprise Governance of Information and Technology (EGIT):

  • Figure 2.1 displays the fundamental balance of enterprise governance:

• COBIT Distinction:

  • Governance: Evaluates stakeholder needs, sets direction through prioritization, and monitors performance/compliance against strategic goals (Board responsibility).

  • Management: Plans, builds, runs, and monitors operational activities in alignment with governance direction (Executive responsibility).

• Recognized Governance Frameworks:

  • COBIT 2019: Comprehensive framework optimizing business value from information and technology.

  • ISO/IEC 27001: International specification for Information Security Management Systems (ISMS).

  • ITIL: Framework for IT Service Management (ITSM).

  • ISO/IEC 38500: Corporate governance of IT principles for governing boards.

  • ISO 31000: Risk management guidelines and principles.

  • Business Intelligence (BI) and Data Flow Architecture:

• Figure 2.2 maps the Enterprise Data Flow Architecture (EDFA):

• EDFA Architectural Layers:

  • Presentation/Desktop Access Layer: Spreadsheets, dashboards, ad-hoc queries, and reporting suites.

  • Data Mart Layer: Business-unit-specific relational databases or Online Analytical Processing (OLAP) multidimensional data cubes.

  • Data Feed / Data Mining Indexing Layer: Algorithms scanning large volumes of data for hidden trends and patterns.

  • Data Warehouse Layer: Centralized, fully normalized relational database storing atomic transaction records.

  • Data Staging and Quality Layer: Data copying, transformation, cleansing, and validation routines.

  • Data Access Layer: Intermediary connectivity between extractors and raw sources.

  • Data Source Layer: Operational data, nonoperational files, and external provider streams.

  • Cross-Cutting Layers: Application Messaging Transport, Warehouse Management, and Metadata Repository (documenting business meaning and context of data definitions).

Domain 2: Governance and Management of IT — Organizational Structure, Roles, and Segregation of Duties

• Governing Committees and Board Responsibilities:

  • IT Strategy Committee: Formed at the board of directors level; advises the board and management on future strategic alignment, IT resource availability, risk exposure, and investment returns.

  • IT Steering Committee: Operational management committee chaired by a sponsoring executive; oversees day-to-day project milestones, budgets, resource conflicts, and vendor contracts.

  • Figure 2.4 maps governance outcomes to organizational levels:

• IT Department Structure and Segregation of Duties (SoD):

  • Figure 2.5 illustrates standard reporting lines across development, operations, systems programming, and administration:

• Figure 2.6 establishes the Segregation of Duties Control Matrix:

• Key Incompatible Combinations:

  • Systems Analyst combined with Application Programmer, End User, or Computer Operator.

  • Application Programmer combined with Computer Operator, Database Administrator (DBA), Systems Administrator, or Quality Assurance.

  • Computer Operator combined with Systems Programmer, Systems Analyst, or DBA.

• Compensating Controls for Small IT Environments:

  • Detailed automated audit trails documenting transactions from source to update.

  • Independent supervisory reconciliation of control totals and master file updates.

  • Timely management review and sign-off on exception reports.

  • Code comparison software checking production source against executable objects.

  • Enterprise Architecture (EA) and Maturity Models:

• Figure 2.7 illustrates the John Zachman Enterprise Architecture Framework:

* Intersects rows (Scope, Enterprise Model, Systems Model, Technology Model, Detailed Representation) with columns (Data, Application, Network, People, Workflow, Strategy).

• Figure 2.8 details Capability Maturity Model Integration (CMMI) levels:

* Level 0: Incomplete — Lack of basic capability; management purpose unaddressed.
* Level 1: Initial — Ad hoc, intuitive, unorganized performance.
* Level 2: Managed — Basic complete set of activities characterized as performed.
* Level 3: Defined — Organized using enterprise organizational assets; well-defined processes.
* Level 4: Quantitatively Managed — Well defined, with performance quantitatively measured.
* Level 5: Optimizing — Continuous process improvement actively pursued via measured feedback.

• Performance Optimization and IT Balanced Scorecard:

  • Figure 2.10 diagrams the four interconnected perspectives of the IT Balanced Scorecard:

* Business Contribution: Value delivery, cost management, and risk alignment from management's perspective.
* User Orientation: Customer and user satisfaction, application availability, and operational partnerships.
* Operational Excellence: Efficiency and effectiveness of IT processes, development life cycles, and operations.
* Future Orientation: Human capital development, training, expertise, and research into emerging technologies.

Domain 3: Information Systems Acquisition, Development, and Implementation — Governance and Life Cycle

• Project Management Structures and Life Cycle:

  • Figure 3.1 outlines the Project Management Life Cycle:

• Figure 3.2 illustrates project organization hierarchies:

• Figure 3.3 diagrams the classic project management trade-offs and resource curves:

• Figure 3.4 diagrams the cyclical phases of project-level benefits realization:

* **Understand**: Define specific project objectives and required business outcomes.
* **Plan**: Construct explicit operational plans to achieve outcomes based on business cases.
* **Realize**: Continuously monitor progress toward goals, track deviations, and update the business case.
* **Report**: Report actual vs. planned results to executive management to maintain accountability.

• Work Breakdown Structure (WBS) and Cost Estimation:

  • Figure 3.5 and Figure 3.6 illustrate decomposition from an Object Breakdown Structure (OBS) down to Work Packages (WPs):

* Work Packages define work, duration, and direct costs for subdeliverables; individual WP duration should not exceed $10$ days.

• Estimation Approaches:

  • Analogous Estimating: Uses actual historical costs from similar past projects.

  • Parametric Estimating: Statistical modeling multiplying historical parameter rates by units of work.

  • Bottom-up Estimating: Individual estimation of every constituent work item, aggregated for total cost.

• Figure 3.7 details Function Point Analysis (FPA) metrics:

* Multiplies counts of User Inputs, User Outputs, User Inquiries, Internal Logical Files, and External Interfaces by complexity factors (Simple, Average, Complex).

• Project Scheduling and Earned Value Analysis:

  • Figure 3.8 and Figure 3.9 illustrate scheduling methods (Gantt vs. PERT):

• Program Evaluation Review Technique (PERT) Equation:

$\text{PERT Duration Estimate} = \frac{\text{Optimistic} + \text{Pessimistic} + 4 \times (\text{Most Likely})}{6}$

• The Critical Path represents the longest sequence of dependent activities through a network; activities on the critical path possess zero slack time (float).

• Earned Value Analysis (EVA) measures progress comparing Planned Value (PV), Actual Cost (AC), and Earned Value (EV).

Domain 3: Information Systems Acquisition, Development, and Implementation — Methodologies and Testing

• System Development Life Cycle (SDLC) and V-Model:

  • Figure 3.10 outlines the Verification and Validation (V-Model):

* Requirements Definition matches directly with User Acceptance Testing (UAT).
* Functional Requirements match with System Testing.
* Architectural Design matches with Integration Testing.
* Detailed Design matches with Unit Testing.

• Software Baselining: The formal freezing of software specifications at a designated point in the design phase; subsequent changes require formal review by the Change Control Board.

  • Physical Architecture and Procurement Flow:

• Figures 3.12, 3.13, 3.14, 3.15, and 3.16 illustrate the procurement and rollout planning pipeline:

• Phased steps include: (1.1) Develop evaluation criteria, (1.2) Develop long list, (1.3) Develop short list, (1.4) Select preferred vendors, and (1.5) Define partnership terms.

  • Application Testing Methodologies:

• Figure 3.20 compares application program testing techniques:

• Key Testing Classifications:

  • Snapshot: Records flow of designated transactions through logic paths; requires advanced IS environment knowledge.

  • Mapping: Analyzes program execution to identify unexecuted/dead code; helps assess unused code.

  • Tracing and Tagging: Shows sequence of executed instructions by attaching tracking indicators to input transactions.

  • Test Data / Test Deck: Simulates data transactions through real programs using dummy master files to verify program edits.

  • Base-case System Evaluation: Comprehensive test data sets used to verify processing accuracy before acceptance.

  • Parallel Operation: Runs actual production data simultaneously through legacy and replacement systems to compare results.

  • Integrated Testing Facility (ITF): Creates dummy entities in live databases to process test transactions alongside production data without operational impact.

  • Parallel Simulation: Uses auditor-written programs to simulate application logic and verify live transaction outputs.

  • System Changeover (Go-Live) Strategies:

• Figure 3.21, Figure 3.22, and Figure 3.23 illustrate changeover approaches:

• Parallel Changeover: Both systems run simultaneously during an overlap period. Lowest operational risk; highest operational cost and double-entry workload.

• Phased Changeover: Modules or business units are transitioned sequentially in increments. Balanced risk profile; requires complex temporary interfaces.

• Abrupt Changeover (Direct Cutover): Complete transition occurring on a single cutoff date. Highest operational risk; lowest direct financial cost; requires a verified fallback rollback plan.

Domain 4: Information Systems Operations and Business Resilience — Operations, Quality, and Data Structures

• Data Quality Framework and Operations Management:

  • Figure 4.4 details the Information Reference Model Quality Criteria:

• Quality Dimensions:

  • Intrinsic Quality: Accuracy, Objectivity, Believability, Reputation.

  • Contextual Quality: Relevancy, Completeness, Currency, Appropriate Amount, Concise Representation, Consistent Representation, Interpretability, Understandability, Ease of Manipulation.

  • Security/Accessibility Quality: Availability, Restricted Access.

  • Database Architecture Models:

• Figure 4.15, Figure 4.16, Figure 4.17, and Figure 4.18 illustrate structural database models:

• Hierarchical: Tree structure featuring $1:N$ parent-child relationships where child segments can have only one parent; pointers navigate downwards.

• Network: Graph-based structure allowing multi-owner relationships; complex to modify or reconstruct.

• Relational: Normalized tables (tuples and domains) linked dynamically by primary and foreign keys; eliminates data redundancy.

• Object-Oriented (OODBMS): Stores data and methods together as unified objects; uses encapsulation and inheritance to handle complex multimedia, engineering, and spatial datasets.

• ACID Transactions in Database Systems:

  • Atomicity: Transactions execute completely or back out entirely.

  • Consistency: State constraints preserved across committed updates.

  • Isolation: Concurrent transactions do not cross-read intermediate data.

  • Durability: Committed transaction records survive hardware crashes.

Domain 4: Information Systems Operations and Business Resilience — Resiliency, Backup, and Continuity

• Business Impact Analysis (BIA) and Recovery Economics:

  • Figure 4.22 shows the cost trade-off between downtime and recovery strategies:

* Downtime costs increase exponentially with elapsed time.
* Recovery strategy costs decrease as allowable recovery windows lengthen.
* Total cost is minimized at the intersection of both curves.

• Data Backup Schemes and Rotation Cycles:

  • Figures 4.26, 4.27, 4.28, and 4.29 detail backup schemes and tape rotation cycles:

• Incremental Backup: Copies only files altered since the last full or incremental backup. Fastest backup execution; requires all consecutive incremental sets to restore.

• Differential Backup: Copies all files changed since the last full backup. Slower than incremental backups; restoration requires only the full backup and the latest differential set.

• Grandfather-Father-Son (GFS) Rotation: Daily backups (Son), Weekly backups (Father), and Monthly backups (Grandfather) rotated systematically to ensure deep historical restore points.

  • Business Continuity Planning (BCP) Process:

• Figure 4.30 diagrams the BCP Life Cycle:

• Figure 4.31 diagrams incident mitigation controls:

• Figure 4.32 specifies incident escalation levels:

* Classifications range from Level 0 (Negligible) up through Level 7 (Crisis).

• Figure 4.33 details the multi-tiered suite of organizational continuity plans:

* Continuity of Operations Plan (COOP): Sustains mission essential functions (MEFs) at an alternate site for up to $30$ days.
* Disaster Recovery Plan (DRP): Relocates and restores information systems operations following long-term catastrophic disruptions.
* Crisis Communications Plan: Coordinates status communications with internal personnel, the public, and regulatory agencies.
* Occupant Emergency Plan (OEP): Coordinates life safety and evacuation procedures during immediate physical threats.

• Recovery Metrics and Alternate Processing Facilities:

  • Figure 4.34 maps recovery metrics to technical solutions:

• Recovery Metrics Defined:

  • Recovery Point Objective (RPO): The acceptable tolerance for data loss measured backwards in time from the moment of disruption.

  • Recovery Time Objective (RTO): The acceptable duration of downtime before systems and processes must resume operations.

• Alternate Processing Sites:

  • Hot Site: Fully equipped operational facility with hardware, networking, and preloaded software ready within hours or minutes.

  • Warm Site: Facility equipped with power, cooling, network links, and peripherals; main processing servers must be shipped and configured.

  • Cold Site: Physical shell equipped with power and raised flooring; requires procurement and setup of all hardware before resumption.

  • Mirrored Site: Fully redundant live facility with synchronous data replication, enabling instantaneous zero-downtime fail-over.

• Figure 4.36 illustrates the progression of disaster recovery tests:

* Progresses from Table-top walk-throughs to Component testing, Application recovery, Integrated end-user testing, Full restoration with unfamiliar personnel, and unannounced Surprise tests.

Domain 5: Protection of Information Assets — Access Controls and Security Architecture

• Access Controls and Categorization:

  • Figure 5.5 structures the Control Matrix:

* Cross-references Managerial, Technical, and Physical controls with Preventive, Detective, and Corrective functions.

• Discretionary vs. Mandatory Access Controls:

  • Mandatory Access Control (MAC): Rigid system-enforced security filters based on fixed object sensitivity labels and subject clearances. Default deny.

  • Discretionary Access Control (DAC): Access granted at the discretion of the resource owner via Access Control Lists (ACLs).

• Biometric Performance Metrics:

  • False Rejection Rate (FRR) / Type I Error: Rate at which authorized users are falsely rejected by the system.

  • False Acceptance Rate (FAR) / Type II Error: Rate at which unauthorized intruders are falsely accepted into the system.

  • Equal Error Rate (EER): The crossover point where $FRR = FAR$; the lower the EER, the higher the biometric accuracy.

  • Network Architectures and the OSI Model:

• Figure 5.10 diagrams the 7-Layer OSI Reference Model and Packet Encapsulation:

* Layer 7 (Application): End-user service interfaces.
* Layer 6 (Presentation): Data translation, character conversion, compression, and encryption.
* Layer 5 (Session): Manages dialogue and connections between end systems.
* Layer 4 (Transport): End-to-end reliability, error recovery, flow control (TCP, UDP).
* Layer 3 (Network): Logical path determination, packet routing, and IP addressing.
* Layer 2 (Data Link): Physical addressing (MAC), framing, and error detection via CRC.
* Layer 1 (Physical): Bitstream transmission across physical electrical, optical, or radio media.

• Figure 5.11 illustrates LAN physical topologies:

* Bus, Ring, and Star.

• Figure 5.12 compares transmission media:

• Figure 5.13 maps the OSI model against the TCP/IP suite:

• Figure 5.14 and Figure 5.15 show URL components and Internet transmission routing:

Domain 5: Protection of Information Assets — Cryptography, Virtualization, and Event Management

• Cryptographic Systems and Public Key Infrastructure (PKI):

  • Figures 5.17, 5.18, 5.19, and 5.20 diagram hashing, symmetric encryption, asymmetric encryption, and digital signatures:

• Symmetric Encryption: Single shared key used for both encryption and decryption (AES, DES, 3DES, RC4). High execution speed; difficult key distribution.

• Asymmetric Encryption: Key pair comprising a public key (for encryption) and private key (for decryption) (RSA, ECC). Solves key distribution; slower processing.

• Digital Signatures: The sender encrypts a message hash with their private key. The receiver verifies integrity and authenticity by decrypting the hash with the sender's public key and comparing it against an independently computed hash. Provides data integrity, sender authentication, and nonrepudiation.

• Public Key Infrastructure (PKI): Certification Authorities (CAs) bind public keys to identities via digital certificates; Registration Authorities (RAs) verify user identity during enrollment; Certificate Revocation Lists (CRLs) track invalidated certificates.

  • Virtualization and Cloud Computing Architectures:

• Figure 5.29 compares virtualization types:

* Bare-Metal (Type 1): Hypervisor executes directly on hardware without a host OS. Higher performance and security isolation.
* Hosted (Type 2): Hypervisor executes within a host operating system. Simpler setup; vulnerable to host OS exploits.
* Containerization: Micro-instances sharing the host OS kernel directly in user space.

• Fraud, Attack Methods, and Security Incident Management:

  • Figure 5.32 illustrates Donald R. Cressey's Fraud Triangle:

* **Motivation (Pressure)**: Financial distress or personal issues.
* **Rationalization**: Justifying dishonest conduct.
* **Opportunity**: Control weaknesses, lack of oversight, or poor SoD. This is the primary element mitigated by internal controls.

• Figure 5.35 outlines penetration testing phases:

* Sequential loop: Planning $\rightarrow$ Discovery $\rightarrow$ Attack $\rightarrow$ Additional Discovery $\rightarrow$ Reporting.

• Figure 5.37 maps the formal stages of Incident Response Management:

* Sequential flow: Planning and Preparation $\rightarrow$ Detection $\rightarrow$ Initiation $\rightarrow$ Recording $\rightarrow$ Evaluation $\rightarrow$ Containment $\rightarrow$ Eradication $\rightarrow$ Escalation $\rightarrow$ Response $\rightarrow$ Recovery $\rightarrow$ Closure $\rightarrow$ Reporting $\rightarrow$ Postincident Review $\rightarrow$ Lessons Learned.

• Computer Forensics and Chain of Custody:

  • Forensic investigation requires four core phases: Identify, Preserve, Analyze, and Present.

  • Physical drives must be imaged using hardware write-blockers to generate bit-for-bit forensic bitstream images; investigations must never be executed on original media.

  • Volatile memory (RAM), network connections, and running processes must be captured prior to shutting down or rebooting systems to avoid losing volatile evidence.

  • A strict chain of custody must document the date, time, custody transfers, and cryptographic hashes verifying that evidence remained untampered throughout legal proceedings.

Questions & Discussion

• Question 1-1: Which of the following outlines the overall authority to perform an IS audit?

  • Options: A. The audit scope with goals and objectives; B. A request from management to perform an audit; C. The approved audit charter; D. The approved audit schedule.

  • Response: C. The approved audit charter outlines the auditor’s responsibility, authority, and accountability.

• Question 1-2: In performing a risk-based audit, which risk assessment is completed FIRST by an IS auditor?

  • Options: A. Detection risk assessment; B. Control risk assessment; C. Inherent risk assessment; D. Fraud risk assessment.

  • Response: C. Inherent risk exists independently of an audit. An IS auditor needs to understand the business process first to understand the inherent risk.

• Question 1-3: Which of the following would an IS auditor MOST likely focus on when developing a risk-based audit program?

  • Options: A. Business processes; B. Administrative controls; C. Environmental controls; D. Business strategies.

  • Response: A. A risk-based audit approach focuses on the understanding of the nature of the business and identifying and categorizing risk to business processes.

• Question 1-4: Which of the following types of audit risk assumes an absence of compensating controls in the area being reviewed?

  • Options: A. Control risk; B. Detection risk; C. Inherent risk; D. Sampling risk.

  • Response: C. Inherent risk is the risk level or exposure without considering the actions that management has taken or might take.

• Question 1-5: An IS auditor performing a review of an application’s controls finds a weakness in system software that could materially impact the application. In this situation, an IS auditor should:

  • Options: A. Disregard these control weaknesses; B. Conduct a detailed system software review; C. Include a statement that the audit was limited; D. Review the system software controls as relevant and recommend a detailed system software review.

  • Response: D. Review the system software controls as relevant to the current review and recommend a separate, detailed system software review.

• Question 1-6: Which of the following is the MOST important reason why an audit planning process should be reviewed at periodic intervals?

  • Options: A. To plan for deployment of available audit resources; B. To consider changes to the risk environment; C. To provide inputs for the audit charter; D. To identify applicable IS audit standards.

  • Response: B. Audit planning must be reviewed periodically to consider changes to the risk environment, technologies, and business processes.

• Question 1-7: Which of the following is MOST effective for implementing a control self-assessment within small business units?

  • Options: A. Informal peer reviews; B. Facilitated workshops; C. Process flow narratives; D. Data flow diagrams.

  • Response: B. Facilitated workshops work best within small business units to foster open communication and control evaluation.

• Question 1-8: Which of the following would an IS auditor perform FIRST when planning an IS audit?

  • Options: A. Define audit deliverables; B. Finalize the audit scope and objectives; C. Gain an understanding of the business’s objectives and purpose; D. Develop the audit approach or strategy.

  • Response: C. The first step in audit planning is gaining an understanding of the business's mission, objectives, and purpose.

• Question 1-9: The approach an IS auditor should use to plan IS audit coverage should be based on:

  • Options: A. risk; B. materiality; C. fraud monitoring; D. sufficiency of audit evidence.

  • Response: A. Audit planning requires a risk-based approach.

• Question 1-10: An organization performs a daily backup of critical data and software files and stores the backup tapes at an offsite location to restore files in case of disruption. This is an example of a:

  • Options: A. preventive control; B. management control; C. corrective control; D. detective control.

  • Response: C. Corrective controls remedy problems and restore operations, reducing the impact of an interruption.

• Question 2-1: In order for management to effectively monitor the compliance of processes and applications, which of the following would be the MOST ideal?

  • Options: A. A central document repository; B. A knowledge management system; C. A dashboard; D. Benchmarking.

  • Response: C. A dashboard provides an integrated set of metrics illustrating the compliance of processes and applications.

• Question 2-2: Which of the following would be included in an IS strategic plan?

  • Options: A. Specifications for planned hardware purchases; B. Analysis of future business objectives; C. Target dates for development projects; D. Annual budgetary targets for the IT department.

  • Response: B. IS strategic plans must address the needs of the business and align with future business objectives.

• Question 2-3: Which of the following BEST describes an IT department’s strategic planning process?

  • Options: A. The IT department will have either short- or long-range plans depending on broader plans; B. The plan must be time- and project-oriented but not detailed; C. Long-range planning for the IT department should recognize organizational goals, technological advances and regulatory requirements; D. Short-range planning does not need integration.

  • Response: C. Long-range IT planning must align with organizational goals, technological changes, and regulatory requirements.

• Question 2-4: The MOST important responsibility of a data security officer in an organization is:

  • Options: A. recommending and monitoring data security policies; B. promoting security awareness; C. establishing procedures for IT security policies; D. administering physical and logical access controls.

  • Response: A. Recommending and monitoring data security policies across the enterprise.

• Question 2-5: What is considered the MOST critical element for the successful implementation of an information security program?

  • Options: A. An effective enterprise risk management framework; B. Senior management commitment; C. An adequate budgeting process; D. Meticulous program planning.

  • Response: B. Senior management commitment is the foundational prerequisite for security programs.

• Question 2-6: An IS auditor should ensure that IT governance performance measures:

  • Options: A. evaluate the activities of IT oversight committees; B. provide strategic IT drivers; C. adhere to regulatory reporting standards; D. evaluate the IT department.

  • Response: A. Evaluating the activities of oversight boards and committees is a key governance measure.

• Question 2-7: Which of the following tasks may be performed by the same person in a well-controlled information processing computer center?

  • Options: A. Security administration and change management; B. Computer operations and system development; C. System development and change management; D. System development and system maintenance.

  • Response: D. System development and system maintenance can be performed by the same programmer within development libraries.

• Question 2-8: Which of the following is the MOST critical control over database administration (DBA)?

  • Options: A. Approval of DBA activities; B. Segregation of duties in regard to access rights granting/revoking; C. Review of access logs and activities; D. Review of the use of database tools.

  • Response: B. Segregation of duties prevents conflicting privileges and unauthorized direct access.

• Question 2-9: When a complete segregation of duties cannot be achieved in an online system environment, which of the following functions should be separated from the others?

  • Options: A. Origination; B. Authorization; C. Recording; D. Correction.

  • Response: B. Authorization should be isolated from origination, recording, and correction.

• Question 2-10: In a small organization where segregation of duties is not practical, an employee performs the function of computer operator and application programmer. Which of the following controls should the IS auditor recommend?

  • Options: A. Automated logging of changes to development libraries; B. Additional staff to provide SoD; C. Procedures that verify that only approved program changes are implemented; D. Access controls preventing program modifications.

  • Response: C. Independent procedures that detect and verify that only approved changes are migrated into production libraries.

• Question 3-1: To assist in testing an essential banking system being acquired, an organization has provided the vendor with sensitive data from its existing production system. An IS auditor’s PRIMARY concern is that the data should be:

  • Options: A. sanitized; B. complete; C. representative; D. current.

  • Response: A. Production test data must be sanitized/masked to prevent confidential data leakage.

• Question 3-2: Which of the following is the PRIMARY purpose for conducting parallel testing?

  • Options: A. To determine whether the system is cost-effective; B. To enable comprehensive unit and system testing; C. To highlight errors in program interfaces; D. To ensure the new system meets user requirements.

  • Response: D. Parallel testing ensures that the new system operates consistently and satisfies user requirements in comparison to the legacy system.

• Question 3-3: When conducting a review of business process reengineering, an IS auditor found that an important preventive control had been removed. In this case, the IS auditor should:

  • Options: A. inform management of the finding and determine whether management is willing to accept the potential material risk; B. determine if a detective control replaced it; C. recommend all pre-existing controls be reinstated; D. develop a continuous audit monitor.

  • Response: A. Inform management immediately to determine whether they formally accept the risk of removing the preventive control.

• Question 3-4: Which of the following data validation edits is effective in detecting transposition and transcription errors?

  • Options: A. Range check; B. Check digit; C. Validity check; D. Duplicate check.

  • Response: B. Check digits are mathematically calculated values added to numbers to detect transcription and transposition errors.

• Question 3-5: Which of the following weaknesses would be considered the MOST serious in enterprise resource planning software used by a financial organization?

  • Options: A. Access controls have not been reviewed; B. Limited documentation is available; C. Two-year-old backup tapes have not been replaced; D. Database backups are performed once a day.

  • Response: A. Unreviewed access controls in a financial ERP expose the organization to significant fraud and unauthorized updates.

• Question 3-6: When auditing the requirements phase of a software acquisition, an IS auditor should:

  • Options: A. assess the reasonability of the project timetable; B. assess the vendor’s proposed quality processes; C. ensure that the best software package is acquired; D. review the completeness of the specifications.

  • Response: D. The auditor must assess whether the functional specifications completely capture business and control requirements.

• Question 3-7: An organization decides to purchase a software package instead of developing it. In such a case, the design and development phases of a traditional SDLC would be replaced with:

  • Options: A. selection and configuration phases; B. feasibility and requirements phases; C. implementation and testing phases; D. nothing, as replacement is not required.

  • Response: A. Acquired software replaces custom design and development with vendor selection and system configuration.

• Question 3-8: User specifications for a software development project using the traditional (waterfall) SDLC methodology have not been met. An IS auditor looking for a cause should look in which of the following areas?

  • Options: A. Quality assurance; B. Requirements; C. Development; D. User training.

  • Response: C. Development failed to adhere to or properly implement the approved user specifications.

• Question 3-9: When introducing thin client architecture, which of the following types of risk regarding servers is significantly increased?

  • Options: A. Integrity; B. Concurrency; C. Confidentiality; D. Availability.

  • Response: D. Consolidating processing onto centralized servers significantly elevates availability risk.

• Question 3-10: Which of the following procedures should be implemented to help ensure the completeness of inbound transactions via electronic data interchange (EDI)?

  • Options: A. Segment counts built into the transaction set trailer; B. A log of received messages periodically verified; C. An electronic audit trail; D. Matching acknowledgment transactions.

  • Response: A. Built-in segment counts in the transaction set trailer verify that every transmitted record is completely received.

• Question 4-1: Which one of the following provides the BEST method for determining the level of performance provided by similar information processing facility environments?

  • Options: A. User satisfaction; B. Goal accomplishment; C. Benchmarking; D. Capacity and growth planning.

  • Response: C. Benchmarking systematically compares operational performance metrics against peer organizations.

• Question 4-2: For mission critical systems with a low tolerance to interruption and a high cost of recovery, the IS auditor, in principle, recommends the use of which of the following recovery options?

  • Options: A. Mobile site; B. Warm site; C. Cold site; D. Hot site.

  • Response: D. Hot sites provide fully configured operations ready to resume critical services within hours or minutes.

• Question 4-3: Which of the following is the MOST effective method for an IS auditor to use in testing the program change management process?

  • Options: A. Trace from system-generated information to the change management documentation; B. Examine documentation for evidence of accuracy; C. Trace from documentation to a system-generated audit trail; D. Examine documentation for completeness.

  • Response: A. Tracing from system-generated production update records back to change requests detects unauthorized changes.

• Question 4-4: Which of the following would allow an enterprise to extend its intranet across the Internet to its business partners?

  • Options: A. Virtual private network; B. Client-server; C. Dial-up access; D. Network service provider.

  • Response: A. Virtual Private Networks (VPNs) create encrypted tunnels across public IP networks to connect extranets.

• Question 4-5: The classification based on criticality of a software application as part of an IS business continuity plan is determined by the:

  • Options: A. nature of the business and the value of the application to the business; B. replacement cost; C. vendor support; D. associated threats and vulnerabilities.

  • Response: A. Criticality is determined by the strategic value of the process supported and its operational importance.

• Question 4-6: When conducting an audit of client-server database security, the IS auditor should be MOST concerned about the availability of:

  • Options: A. system utilities; B. application program generators; C. systems security documentation; D. access to stored procedures.

  • Response: A. System utilities can bypass access controls and modify database records directly without leaving audit trails.

• Question 4-7: When reviewing a network used for Internet communications, an IS auditor will FIRST examine the:

  • Options: A. validity of password change occurrences; B. architecture of the client-server application; C. network architecture and design; D. firewall protection and proxy servers.

  • Response: C. Understanding the overarching network architecture and physical/logical design is the prerequisite first step.

• Question 4-8: An IS auditor should be involved in:

  • Options: A. observing tests of the disaster recovery plan; B. developing the plan; C. maintaining the plan; D. reviewing supplier contract DR requirements.

  • Response: A. The IS auditor should independently observe DR tests to verify procedural execution and report findings.

• Question 4-9: Data mirroring should be implemented as a recovery strategy when:

  • Options: A. recovery point objective (RPO) is low; B. RPO is high; C. recovery time objective (RTO) is high; D. disaster tolerance is high.

  • Response: A. A near-zero or low RPO requires real-time synchronous data mirroring to eliminate data loss.

• Question 4-10: Which of the following components of a business continuity plan is PRIMARILY the responsibility of an organization’s IS department?

  • Options: A. Developing the business continuity plan; B. Selecting and approving recovery strategies; C. Declaring a disaster; D. Restoring the IT systems and data after a disaster.

  • Response: D. The technical restoration of IT systems, networks, and data backups is the core responsibility of the IS department.

• Question 5-1: An IS auditor reviewing the configuration of a signature-based intrusion detection system would be MOST concerned if which of the following is discovered?

  • Options: A. Auto-update is turned off; B. Scanning for application vulnerabilities is disabled; C. Analysis of encrypted data packets is disabled; D. The IDS is placed between the demilitarized zone and the firewall.

  • Response: A. Disabling automatic signature updates leaves signature-based IDSs blind to emerging threats.

• Question 5-2: Which of the following BEST provides access control to payroll data being processed on a local server?

  • Options: A. Logging access to personal information; B. Using separate passwords for sensitive transactions; C. Using software that restricts access rules to authorized staff; D. Restricting system access to business hours.

  • Response: C. Restricting logical access permissions through software to authorized personnel based on job role.

• Question 5-3: An IS auditor has just completed a review of an organization that has a mainframe computer and two database servers where all production data reside. Which of the following weaknesses would be considered the MOST serious?

  • Options: A. The security officer also serves as DBA; B. Password controls are not administered over the two database servers; C. There is no BCP for noncritical mainframe apps; D. LAN file-server disks are not backed up regularly.

  • Response: B. Complete absence of password authentication on production database servers creates immediate catastrophic exposure.

• Question 5-4: An organization is proposing to install a single sign-on facility giving access to all systems. The organization should be aware that:

  • Options: A. maximum unauthorized access would be possible if a password is disclosed; B. user access rights would be restricted; C. the administrator's workload would increase; D. user access rights would be increased.

  • Response: A. Single sign-on creates a single point of failure where a compromised credential grants access across all federated systems.

• Question 5-5: When reviewing an implementation of a Voice-over Internet Protocol system over a corporate wide area network, an IS auditor should expect to find:

  • Options: A. an ISDN data link; B. traffic engineering; C. WEP encryption; D. analog phone terminals.

  • Response: B. Traffic engineering and quality of service (QoS) configurations prioritize latency-sensitive voice packets.

• Question 5-6: An insurance company is using public cloud computing for one of its critical applications to reduce costs. Which of the following would be of MOST concern to the IS auditor?

  • Options: A. Inability to recover service in a major technical failure; B. Data in the shared environment being accessed by other companies; C. The provider not including investigative support; D. Long-term viability of the provider.

  • Response: B. Multi-tenancy isolation failure leading to unauthorized access and data leakage of sensitive customer information.

• Question 5-7: Which of the following BEST determines whether complete encryption and authentication protocols for protecting information while being transmitted exist?

  • Options: A. Digital signature with RSA; B. Work is being done in tunnel mode with nested services of AH and ESP; C. Digital certificates with RSA; D. Work is being done in transport mode with AH and ESP.

  • Response: B. IPSec in tunnel mode nesting Authentication Header (AH) and Encapsulating Security Payload (ESP) encrypts the whole packet and authenticates the header.

• Question 5-8: Which of the following concerns about the security of an electronic message would be addressed by digital signatures?

  • Options: A. Unauthorized reading; B. Theft; C. Unauthorized copying; D. Alteration.

  • Response: D. Digital signatures detect unauthorized alteration, ensuring message integrity and nonrepudiation.

• Question 5-9: Which of the following characterizes a distributed denial-of-service attack?

  • Options: A. Central initiation of intermediary computers to direct simultaneous spurious message traffic at a specified target site; B. Local initiation; C. Central initiation at multiple target sites; D. Local initiation of staggered traffic.

  • Response: A. Centralized command-and-control coordinating compromised zombie machines to flood a target site simultaneously.

• Question 5-10: Which of the following is the MOST effective preventive antivirus control?

  • Options: A. Scanning email attachments on the mail server; B. Restoring systems from clean copies; C. Disabling USB ports; D. An online antivirus scan with up-to-date virus definitions.

  • Response: D. Real-time, continuous online antivirus scanning configured with automatically updated signature files.