Chapter 1 of 5 · ISACA CISA
Information Systems Auditing Process
Audit standards and ethics, audit types, risk-based planning, controls, sampling, evidence, analytics, reporting and quality.
- 5topics
- 16 minfast track
- 2diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Audit Standards, Ethics and Types of AuditsISACA IS audit standards and guidelines, the code of professional ethics, the audit charter, independence, and types of audits…4 min
- 2Risk-Based Audit Planning and Types of ControlsRisk-based IS audit planning, audit risk and its components, materiality, the audit universe, and preventive, detective and…Diagram3 min
- 3Audit Project Management and SamplingManaging an IS audit engagement, compliance and substantive tests, statistical and judgmental sampling, attribute and variable…Diagram3 min
- 4Audit Evidence and Data AnalyticsSufficient and reliable audit evidence, collection techniques such as reperformance, CAATs, continuous auditing techniques and…3 min
- 5Audit Reporting and Quality AssuranceStructuring IS audit findings, the exit meeting, management responses, follow-up of recommendations and quality assurance of the…3 min
About this chapter
What this chapter covers
The Information Systems Auditing Process is worth 18 percent of the CISA exam. It is the auditor's own craft: how an IS audit is planned, carried out, reported and kept to a professional standard. Every other domain is examined through this lens, so the habits learned here decide many questions in the rest of the exam.
Planning (1A) covers IS audit standards, guidelines and the code of ethics, the types of audits, assessments and reviews, risk-based audit planning and the types of controls. Execution (1B) covers audit project management, testing and sampling, evidence collection, audit data analytics, reporting and communication and quality assurance of the audit function.
How the topics fit together
The charter gives the audit function its authority. A risk assessment decides where audit effort goes. Fieldwork gathers sufficient, reliable evidence, and the report gives management findings and recommendations that are then followed up.
CISA questions are asked from the IS auditor's viewpoint. The auditor recommends, reports and verifies; management decides and implements. An option in which the auditor fixes the problem personally is usually wrong.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.