CISA – Certified Information Systems Auditor Study Guide: Aligned with the CISA Review Manual 2024 with over 1000 practice questions to ace the exam , Third Edition

Hemang Doshi

$35.98 ~~$39.99~~

5 (1 Ratings)

eBook Oct 2024 356 pages 3rd Edition

Hemang Doshi

$35.98 ~~$39.99~~

5 (1 Ratings)

eBook Oct 2024 356 pages 3rd Edition

What do you get with eBook?

Instant access to your Digital eBook purchase

Download this book in EPUB and PDF formats

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

AI Assistant (beta) to help accelerate your learning

View table of contents

Preview Book

CISA – Certified Information Systems Auditor Study Guide

Audit Execution

In the first chapter, you learned about audit-planning procedures and best practices. In this chapter, you will learn how to effectively and efficiently execute the audit plan. Audit execution involves gathering and analyzing evidence, testing internal controls, and documenting findings to ensure accuracy and thoroughness. It includes identifying issues, communicating progress with stakeholders, and managing resources effectively.

This chapter covers Domain 1, Information Systems Auditing Process, part B, Execution, of the CISA exam. The following topics will be covered in this chapter:

Audit project management
Audit testing and Sampling methodology
Audit evidence collection techniques
Data analytics
Reporting and communication techniques
Control self-assessment
Agile auditing
Quality assurance of audit processes
Use of AI in the audit process

By the end of this chapter, you will have detailed knowledge of information systems (ISs), business, and risk management processes that help protect the assets of an organization.

Audit Project Management

An audit includes various activities, such as audit planning, resource allocation, determining the audit scope and audit criteria, reviewing and evaluating audit evidence, forming audit conclusions, and reporting to management. All these activities are integral parts of an audit, and project management techniques are equally applicable to audit projects.

Audit Objectives

Audit objectives are the expected outcomes of the audit activities. They refer to the intended goals that the audit must accomplish. Determining the audit objectives is a very important step in planning an audit. Generally, audits are conducted to achieve the following objectives:

To confirm that internal control exists
To evaluate the effectiveness of internal controls
To confirm compliance with statutory and regulatory requirements

An audit also provides reasonable assurance about the coverage of material items.

Audit Phases

The audit management project process has three phases. The first phase is planning, the second phase is execution, and the third phase is reporting. An IS auditor should be aware of the steps involved in the phases of an audit management process, as shown in the following table:

Phase	Audit Steps	Description
Planning	Assess risk and determine audit areas	The first step is to conduct a risk assessment and identify the function, process, system, and physical location to be audited
	Determine audit objective	The primary goal during the planning stage of an IS audit is to address the audit objectives The audit objective (i.e., the audit purpose) is also to be determined An audit may be conducted for regulatory or contractual requirements
	Determine the audit scope	The next step is to identify and determine the scope of the audit The scope may be restricted to a few applications or a few processes only Defining the scope will help the auditor determine the resources required for conducting the audit
	Conduct pre-audit planning	Pre-audit planning includes understanding the business environment and the relevant regulations It includes conducting risk assessments to determine areas of high risk It also includes determining resource requirements and audit timings
	Determine audit procedures	The audit program is designed on the basis of pre-audit information, which includes resource allocation and audit procedures to be followed During this step, audit tools and audit methodology are developed to test and verify the controls
Execution	Gather data	The next step is to gather relevant data and documents for conducting the audit
	Evaluate controls	Once the required information, data, and documents are available, the auditor is required to evaluate the controls to verify their effectiveness and efficiency
	Validate and document the results	Audit observations should be validated and documented along with the relevant evidence
Reporting	Draft report	A draft report should be issued to obtain comments from management on the audit observations Before issuance of the final report, the draft report should be discussed with management
	Issue report	The final report should contain audit findings, recommendations, comments, and the expected date of closure of the audit findings
	Follow up	A follow-up should be done to determine whether the audit findings are closed and a follow-up report should be issued

Table 2.1: Phases of an audit process

It should be noted that the steps should be followed in chronological sequence for the success of the audit project and to achieve the audit objectives.

Key Aspects for the CISA Exam

The following table covers the important aspects from the CISA exam perspective:

Questions	Possible Answers
What does an IS audit provide?	Reasonable assurance about the coverage of material items
What is the first step of an audit project?	To develop an audit plan
What is the major concern in the absence of established audit objectives?	Not being able to determine key business risks
What is the primary objective of performing a risk assessment prior to the audit?	Allocating audit resources to areas of high risk
What is the first step of the audit planning phase?	Conducting risk assessments to determine the areas of high risk
What is an important consideration when planning the scope and objectives of an IS audit?	Applicable statutory requirements

Table 2.2: Key aspects for the CISA exam

Audit sampling is an important element of audit project management and selecting an appropriate sampling methodology is critical for gathering the relevant data and drawing accurate conclusions. The next section discusses sampling methodologies.

Download Code

Key benefits

Learn from a qualified CISA and bestselling instructor, Hemang Doshi
Aligned with the latest CISA exam objectives from the 28th edition of the Official Review Manual
Assess your exam readiness with over 1000 targeted practice test questions along with flashcards and exam tips

Description

Following on from the success of its bestselling predecessor, this third edition of the CISA - Certified Information Systems Auditor Study Guide serves as your go-to resource for acing the CISA exam. Written by renowned CISA expert Hemang Doshi, this guide equips you with practical skills and in-depth knowledge to excel in information systems auditing, setting the foundation for a thriving career. Fully updated to align with the 28th edition of the CISA Official Review Manual, this guide covers the latest exam objectives and provides a deep dive into essential IT auditing areas, including IT governance, systems development, and asset protection. The book follows a structured, three-step approach to solidify your understanding. First, it breaks down the fundamentals with clear, concise explanations. Then, it highlights critical exam-focused points to ensure you concentrate on key areas. Finally, it challenges you with self-assessment questions that reflect the exam format, helping you assess your knowledge. Additionally, you’ll gain access to online resources, including mock exams, interactive flashcards, and invaluable exam tips, ensuring you’re fully prepared for the exam with unlimited practice opportunities. By the end of this guide, you’ll be ready to pass the CISA exam with confidence and advance your career in auditing.

Who is this book for?

This CISA study guide is for professionals preparing for the CISA exam, including IT auditors, security analysts, and risk managers. It’s ideal for those with a non-technical background looking to advance in IT audit, governance, and security management.