JT
JT Exams
Log inStart Free Trial
SecurityCISA

CISA Audit and Assurance: IT Audit Frameworks, Evidence, and Control Testing

The CISA (Certified Information Systems Auditor) is one of the most respected credentials in IT governance and audit. It proves you can independently assess whether an organisation's information systems are secure, reliable, and compliant. Unlike certifications focused on attacking or defending systems, CISA is about systematically evaluating evidence and forming an objective opinion on control effectiveness. Banks, regulators, and Big Four consulting firms rely on CISA holders to answer the question: 'Can we trust this system?'

12 min
5 sections · 10 exam key points

The Audit Process: Planning, Fieldwork, and Reporting

ISACA structures the audit process in five phases. Planning: define scope (what systems, processes, and time periods are in scope?), set objectives (what questions will the audit answer?), conduct risk assessment (where is risk highest — focus resources there), develop audit programme (test procedures and sample sizes). Fieldwork: gather evidence through observation (watching processes happen in real time), inquiry (interviewing personnel — corroborate with other evidence), inspection (reviewing documents, logs, configurations), reperformance (independently re-executing a control to verify it works). Reporting: communicate findings to management, classify deficiencies by severity (observation, finding, significant finding, material weakness — material weakness means a control cannot prevent or detect a material misstatement), issue formal report with management responses and remediation commitments. Follow-up: verify that remediation actions were completed.

IS Audit Standards and ISACA Code of Professional Ethics

CISA holders must comply with ISACA's IS Audit Standards, which set minimum requirements for audit work. The Code of Professional Ethics requires: support the implementation of appropriate standards, perform duties with objectivity and due care, serve stakeholders in a lawful and honest manner, maintain confidentiality of information acquired in audits, support professional education, inform appropriate parties of illegal activity discovered, do not engage in conduct that discredits the profession. Auditor independence is the cornerstone of audit credibility. Organisational independence means the audit function reports to the board or audit committee, not to the executives being audited. Individual independence means the auditor has no financial interest in, or personal relationship with, the auditee that would bias judgment.

Control Frameworks: COBIT, ITIL, and ISO 27001

CISA candidates need to understand the major IT governance and control frameworks. COBIT 2019 (Control Objectives for Information and Related Technologies): a governance and management framework published by ISACA itself. It organises IT governance into five domains: Evaluate, Direct, Monitor (governance), and Align, Plan, Organise; Build, Acquire, Implement; Deliver, Service, Support; Monitor, Evaluate, Assess (management). COBIT maps goals from enterprise level down to IT processes and specific control objectives — useful for justifying controls in audit findings. ISO/IEC 27001: international standard for information security management systems (ISMS). Annex A lists 93 controls across four themes. Certification requires documented implementation and third-party audit. ITIL (IT Infrastructure Library): service management framework — focuses on service delivery quality, not security controls per se, but overlaps with change management and availability controls.

IT Risk and Control Assessment

Risk assessment in audit context: identify threats to information assets (confidentiality, integrity, availability), assess likelihood and impact, determine inherent risk (before controls), assess control effectiveness, determine residual risk (after controls). Control types: preventive (stop the error before it happens — access controls, input validation), detective (identify errors that occurred — logs, reconciliations, exception reports), corrective (fix errors identified — backup restoration, patch management). Control testing approaches: test of design (is the control designed to prevent the risk?), test of operating effectiveness (is the control working correctly every time?). Sampling: statistical sampling allows inference to the whole population; non-statistical sampling uses auditor judgment. For high-risk controls, auditors typically require larger samples and may require 100% population testing.

Business Continuity and Disaster Recovery Audit

BC/DR auditing is a major CISA domain. Key audit objectives: Is there a documented BCP/DRP? Has it been tested within the past 12 months? Are RTOs and RPOs defined per system and aligned with business impact analysis? Is the alternate processing site tested and viable? Are backup tapes/snapshots stored offsite and tested for restorability? Audit evidence for BCP: BIA document (identifies critical processes and recovery priorities), test exercise reports (tabletop exercises, simulation exercises, full failover tests), backup logs and restoration test records, vendor contracts for cloud failover capacity. Common findings: BCP exists but has never been tested; recovery time assumptions are not based on actual timed tests; critical systems have no documented RTO; offsite backups are not encrypted.

Key exam facts — CISA

  • Audit evidence types: observation, inquiry, inspection, reperformance — corroborate inquiry with documentary evidence
  • Material weakness means a control cannot prevent or detect a material misstatement
  • Auditor independence: reports to board/audit committee, no financial interest in auditee
  • COBIT 2019 is ISACA's governance framework; ISO 27001 is the ISMS certification standard
  • Control types: preventive (stop), detective (find), corrective (fix)
  • Test of design vs test of operating effectiveness — both required for assurance
  • BCP must be tested to have audit value; a plan that has never been tested is unreliable evidence
  • Statistical sampling allows population inference; non-statistical uses auditor judgment
  • CISA Code of Ethics requires objectivity, confidentiality, and reporting of illegal activity
  • Residual risk = inherent risk minus the effect of controls

Common exam traps

CISA is only for financial auditors

CISA covers all aspects of IS audit: IT governance, system development, IT operations, network security, and BCP. Many CISA holders come from IT backgrounds, not accounting.

A clean audit means there are no security vulnerabilities

An audit provides reasonable assurance that controls are operating effectively at the time tested. It does not certify the absence of vulnerabilities — only that tested controls were functioning within their design.

Management's responses to findings are optional

Management responses are required in professional audit reports. They document whether management agrees with the finding, planned remediation, and responsible party and date — and they create accountability for follow-up.

COBIT and ISO 27001 are competing standards — you pick one

COBIT and ISO 27001 are complementary. COBIT provides an IT governance framework; ISO 27001 provides a security management system standard. Many organisations implement both, using COBIT for governance structure and ISO 27001 for security controls.

Practice this topic

CISApractice questions

Test yourself on CISA Audit and Assurance

JT Exams routes you to questions in your exact weak areas — automatically, after every session.

Free practice testStart 7-Day Free Trial

No credit card · Cancel anytime

Related certification topics

CISM Security Governance

CISM

CISSP Security Domains

CISSP