Overview
Information Systems Auditing Process covers the full life of an IS audit engagement. Its 10 sub-topics split into planning (audit standards and the ISACA Code of Professional Ethics, types of audits and reviews, risk-based audit planning, types of controls) and execution (project management, testing and sampling, evidence collection, data analytics, reporting, and quality assurance of the audit function itself).
Candidates must reason as an independent assurance provider, not as the person who fixes the system. You need to know how audit risk is built from inherent, control and detection risk, when to use a compliance test versus a substantive test, which evidence is most reliable, and what to do when management disagrees with a finding. Domains 2 to 5 describe the things you audit; this domain describes how you audit them, so every scenario in those domains still turns on the planning, evidence and reporting rules learned here.
How it's tested
Questions are short scenarios that place you mid-engagement and ask what the IS auditor should do FIRST, what is MOST important, or which evidence is BEST. Several options are good practice; one fits the auditor's role, the audit phase and the risk described. Expect few calculations and a strong emphasis on sequencing and independence.
-
Role boundary
One option has the auditor implement, design or approve a control. Unless the scenario is a pre-implementation advisory review, the auditor recommends and reports rather than operates.
-
Phase and sequencing
Options mix planning, fieldwork and reporting actions. Identify the phase the scenario sits in and pick the action that belongs there, such as understanding the business and its risks before writing the audit program.
-
Evidence quality
Several items of evidence are offered and you choose the most reliable or sufficient. Rank by source independence, the auditor's direct involvement and objectivity.
During fieldwork an auditor finds that several production changes lack approval, and the IT manager offers to fix the workflow at once. Options include helping configure the workflow, expanding the sample, or reporting. Reason it through: the auditor is in fieldwork, so first establish the extent of the problem by expanding testing, then report the condition and cause. Helping configure it would compromise independence.
Sub-topics 10
Official sub-topics from the ISACA outline, in outline order.
1.1 IS Audit Standards, Guidelines, and Codes of EthicsISACA's mandatory standards, supporting guidelines and the Code of Professional Ethics.
- What it means
- ISACA's IT Audit Framework (ITAF) separates mandatory IS audit and assurance standards from guidelines and from tools and techniques. The Code of Professional Ethics binds every CISA holder, and the audit charter grants the audit function its authority, scope and reporting line.
- What to understand
- Standards are mandatory, guidelines explain how to apply them, and tools and techniques are examples. Independence has two parts: organizational (the function reports to the audit committee or board) and in fact and appearance (the individual auditor has no conflicting role). The charter is approved at board or audit committee level, not by IT management.
- How it shows up
- A scenario describes an auditor asked to audit a system they helped build or a department they recently managed, and asks for the best response, which is to disclose the impairment and step aside or have the work reviewed.
- Common confusion
- Candidates treat a guideline as binding or assume the engagement letter replaces the audit charter; the charter sets the function's overall mandate, while an engagement letter scopes a single assignment, often for external or outsourced work.
1.2 Types of Audits, Assessments, and ReviewsCompliance, financial, operational, integrated, IS, forensic and specialized audits, plus control self-assessment.
- What it means
- Audits differ by objective: compliance audits test adherence to rules, financial audits test the fairness of statements, operational audits test efficiency and effectiveness, integrated audits combine financial, operational and IT control testing, and forensic audits gather evidence for possible legal action. Assessments and reviews, including control self-assessment (CSA), are usually less formal and need not produce an independent opinion.
- What to understand
- The audit type sets the criteria, the evidence standard and who relies on the result. CSA shifts first-line responsibility for control monitoring to the business, improving ownership, but it supplements rather than replaces independent audit. Reports on third-party service organizations give assurance about controls you cannot test directly.
- How it shows up
- A question names a goal, such as preparing for possible litigation over suspected fraud, and asks which engagement type fits; the clue words are evidence handling and legal admissibility, pointing to a forensic audit.
- Common confusion
- Thinking CSA lets the audit function step back entirely; its main benefit is earlier detection and business ownership of controls, and auditors still validate the results.
1.3 Risk-Based Audit PlanningUsing risk to choose what to audit, how deep, and with what tests.
- What it means
- Audit risk is the risk of reaching an incorrect conclusion, built from inherent risk (exposure before controls), control risk (controls fail to prevent or detect) and detection risk (the auditor's procedures miss a material error). Only detection risk is under the auditor's direct control.
- What to understand
- When inherent and control risk are assessed high, the auditor lowers detection risk by doing more or stronger substantive testing. Planning starts with understanding the business, its processes, applicable regulations and the prior audit results, then prioritizes the audit universe by risk so limited resources go to the highest exposures. Materiality guides which errors would change a conclusion.
- How it shows up
- Scenarios ask what the auditor should do FIRST when starting an engagement or annual plan; the answer is usually to understand the business and perform or review a risk assessment before selecting controls to test.
- Common confusion
- Treating detection risk as something management controls, or believing a risk-based plan means auditing every area annually; it means auditing high-risk areas more often and in more depth.
1.4 Types of Controls and ConsiderationsPreventive, detective and corrective controls; general versus application controls; compensating controls.
- What it means
- Controls are classified by function (preventive, detective, corrective, plus deterrent and compensating) and by layer: IT general controls cover change management, access and operations across systems, while application controls such as input validation, processing totals and output reconciliation sit inside a specific system.
- What to understand
- Application controls can only be relied on if the general controls beneath them are effective, because a weak change process lets anyone alter the validation logic. A compensating control reduces the risk left by a missing primary control, for example a supervisory review when segregation of duties is impossible in a small team.
- How it shows up
- A question describes a control, such as a batch hash total compared after transmission, and asks what type it is, or describes a small department where one person holds conflicting duties and asks for the best compensating control.
- Common confusion
- Labeling a control by its technology rather than its timing; a log review is detective even though it uses an automated tool, and a reconciliation that finds and fixes errors after processing is detective with a corrective element, not preventive.
1.5 Audit Project ManagementPlanning, executing, supervising and closing an engagement within scope, time and budget.
- What it means
- Each engagement moves through planning (objectives, scope, criteria, resources), fieldwork (executing the audit program), reporting and follow-up. The audit program lists the steps that will gather sufficient, appropriate evidence for each objective.
- What to understand
- Objectives define what you will conclude on; scope defines which systems, locations and periods are covered. Scope changes, resource shortfalls or newly found high risks must be communicated and agreed rather than silently absorbed. Supervision and documented review of workpapers are part of the engagement, not optional extras.
- How it shows up
- A scenario reports that fieldwork is behind schedule or that the auditee restricts access to a key system, and asks what the auditor should do; the answer is to communicate the limitation to audit management and, if unresolved, report it as a scope limitation.
- Common confusion
- Assuming the auditor should quietly narrow scope to finish on time; an unreported scope reduction can make the opinion misleading.
1.6 Audit Testing and Sampling MethodologyCompliance versus substantive testing and the sampling methods that support each.
- What it means
- Compliance tests check whether a control operates as designed, for example that change tickets carry approvals. Substantive tests check the integrity of actual data or transactions, for example recalculating interest. Sampling lets the auditor conclude on a population from a subset.
- What to understand
- Attribute sampling estimates a rate of occurrence and suits compliance tests; variable sampling estimates a monetary or numeric value and suits substantive tests. Stop-or-go sampling ends early when few errors are found, and discovery sampling seeks at least one example when fraud or a rare deviation is suspected. Higher confidence or a lower tolerable error rate requires a larger sample.
- How it shows up
- Questions describe a test objective and ask which sampling method fits, or ask what happens to sample size when the confidence level rises or the expected error rate increases.
- Common confusion
- Pairing attribute sampling with dollar values or variable sampling with yes-or-no control checks; also forgetting that strong compliance test results let the auditor reduce, not eliminate, substantive testing.
1.7 Audit Evidence Collection TechniquesInquiry, observation, inspection, reperformance and analytics, and how reliable each is.
- What it means
- Evidence must be sufficient (enough of it), appropriate (relevant and reliable) and documented in workpapers. Techniques include reviewing documents, interviewing, observing processes, reperforming controls and running computer-assisted tests.
- What to understand
- Reliability rises when evidence comes from an independent source, is obtained directly by the auditor, is objective rather than opinion, and comes from a well-controlled system. Inquiry alone is the weakest technique and needs corroboration. Reperformance by the auditor is generally stronger than observation, because observation shows only what happened while the auditor watched.
- How it shows up
- A question lists four items of evidence about the same control and asks which is MOST reliable; the auditor's own system extract or reperformance usually beats a report prepared by the auditee.
- Common confusion
- Ranking written management representations as strong evidence; they confirm management's position but do not prove a control works.
1.8 Audit Data AnalyticsComputer-assisted audit techniques, generalized audit software and continuous auditing.
- What it means
- Computer-assisted audit techniques (CAATs) let auditors test entire populations: generalized audit software extracts and analyzes data, while embedded techniques such as an integrated test facility, snapshots, audit hooks and embedded audit modules test processing as it happens.
- What to understand
- Analytics increase coverage and can replace sampling for some tests, but only if the data is complete and accurate, so the auditor first validates the extract against control totals or record counts. Continuous auditing suits high-volume, paperless processes where traditional periodic testing would miss issues; it depends on the auditor understanding the system well enough to place the checks.
- How it shows up
- A scenario describes a high-volume online system where transactions leave little paper trail and asks which technique is BEST; embedded or continuous techniques fit, while manual sampling does not.
- Common confusion
- Running analytics on a production extract without confirming its completeness, or confusing an integrated test facility (dummy entity processed with live data) with a test deck run outside production.
1.9 Reporting and Communication TechniquesFindings, exit meetings, management responses, report distribution and follow-up.
- What it means
- A finding states the condition, the criteria it breaches, the cause, the effect or risk, and a recommendation. Findings are discussed with the auditee before the report is final, management responses and action plans are recorded, and follow-up confirms the actions were taken.
- What to understand
- The auditor discusses facts to confirm accuracy but does not drop or soften a supported finding because management objects or has already fixed it; a corrected issue is reported as corrected. Material issues go to the audit committee, and the auditor follows up rather than taking responsibility for implementing the fix.
- How it shows up
- A question describes management disputing a finding or fixing it during fieldwork and asks what the auditor should do; the answer is to include the finding with management's response, noting any remediation.
- Common confusion
- Believing the exit meeting exists to negotiate findings away; its purpose is to confirm facts and agree action plans, not to change conclusions.
1.10 Quality Assurance and Improvement of Audit ProcessSupervision, workpaper review, internal and external quality assessments, and audit metrics.
- What it means
- The audit function assures the quality of its own work through supervision and documented review of each engagement, periodic internal self-assessments, and independent external quality assessments of the function as a whole.
- What to understand
- Quality assurance checks conformance with standards, the charter and the code of ethics, and feeds an improvement program with metrics such as audit plan completion, finding implementation rates and stakeholder feedback. Responsibility for audit quality sits with audit management, reporting results to the audit committee.
- How it shows up
- A scenario asks how a chief audit executive can BEST show stakeholders that the audit function meets professional standards; an independent external quality assessment is stronger than internal metrics alone.
- Common confusion
- Treating auditee satisfaction scores as proof of audit quality; they measure relationships, not conformance with standards or the accuracy of conclusions.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Audit risk model
Audit risk combines inherent risk, control risk and detection risk; the first two belong to the auditee's environment, while detection risk depends on the auditor's procedures.
- Remember
- When inherent or control risk is high, the auditor reduces detection risk by testing more, testing closer to period end, or using stronger substantive procedures.
- Tested as
- Planning questions ask which risk the auditor can directly influence or how to respond to a high assessed risk.
- Trap
- Saying the auditor can lower control risk; that would require changing the auditee's controls, which is management's job.
-
Compliance test vs. substantive test
A compliance test asks whether a control operated as designed during the period, while a substantive test examines the actual balances, transactions or data for errors.
- Remember
- Strong compliance results justify less substantive testing; weak results require more, because the controls cannot be relied on.
- Tested as
- Scenarios describe a test step and ask which kind it is or what the auditor should do after controls fail.
- Trap
- Classifying a review of change approvals as substantive because it involves examining records; it tests a control, so it is a compliance test.
-
Attribute vs. variable sampling
Attribute sampling estimates how often a characteristic occurs, such as missing approvals, and variable sampling estimates a quantity, such as the total value of misstated invoices.
- Remember
- Attribute sampling goes with compliance tests and rate-based conclusions; variable sampling goes with substantive tests and monetary conclusions.
- Tested as
- Questions give a test objective and ask which sampling approach fits.
- Trap
- Choosing variable sampling for a yes-or-no control check because it sounds more precise.
-
Stop-or-go and discovery sampling
Stop-or-go sampling lets the auditor end testing early when the first small sample shows few or no errors; discovery sampling is designed to find at least one occurrence of a rare event such as fraud.
- Remember
- Use stop-or-go to avoid over-sampling when error rates are expected to be low; use discovery when even one instance would matter.
- Tested as
- These appear as distractors or answers in questions about efficient testing and fraud detection.
- Trap
- Using discovery sampling to estimate an error rate; it only tells you whether an occurrence exists, not how often it happens.
-
Sample size drivers
Sample size grows with a higher confidence level, a lower tolerable error rate and a higher expected error rate, and shrinks as those move the other way.
- Remember
- Confidence coefficient up means sample up; tolerable error up means sample down.
- Tested as
- Direct questions ask which change would increase or decrease the required sample.
- Trap
- Assuming a larger population always needs a proportionally larger sample; for large populations size has little effect.
-
Evidence reliability hierarchy
Evidence is more reliable when it comes from an independent external source, is obtained directly by the auditor, is objective, and is produced by a system with effective controls.
- Remember
- Reperformance and auditor-generated extracts generally beat auditee-prepared reports, which beat inquiry alone.
- Tested as
- Questions that ask for the MOST reliable evidence turn on this ranking.
- Trap
- Picking a signed management confirmation because it looks formal; it is still the auditee's own assertion.
-
Materiality in IS audit
Materiality judges whether an error or weakness would change a conclusion or a user's decision, and in IS audit it includes non-monetary effects such as a control gap that exposes sensitive data.
- Remember
- A small-value weakness can be material if it affects many transactions, a critical system or legal compliance.
- Tested as
- Reporting questions ask whether to include a finding or how to prioritize several findings.
- Trap
- Applying a purely monetary threshold and dismissing an access-control gap because no loss has occurred yet.
-
Auditor independence
Independence means the audit function reports to a level that lets it act freely, usually the audit committee, and each auditor is free of conflicting roles in the area audited, in fact and in appearance.
- Remember
- Designing, implementing or operating a control impairs independence over auditing it; advising on control requirements during a project does not, if the auditor does not make management decisions.
- Tested as
- Scenarios test whether an auditor can review a system they helped select or configure.
- Trap
- Assuming any project involvement bars later auditing; the issue is taking management or operational responsibility.
-
Continuous auditing techniques
Embedded audit modules, snapshots, audit hooks, an integrated test facility and continuous and intermittent simulation test transactions while systems run, flagging exceptions close to real time.
- Remember
- These fit high-volume, paperless environments and need the auditor involved early so checks can be built into the system.
- Tested as
- Questions ask which technique fits a scenario with no paper trail or a need for timely detection.
- Trap
- Choosing generalized audit software for real-time detection; it analyzes extracted data after the fact.
-
Components of a finding
A complete finding states the condition found, the criteria it breaches, the root cause, the effect or risk, and a recommendation that addresses the cause.
- Remember
- Recommendations should address root cause, not only the symptom found in the sample.
- Tested as
- Reporting questions ask what is missing from a draft finding or what makes a recommendation effective.
- Trap
- Recommending that the specific failed transactions be corrected without addressing the process that let them happen.
-
Audit charter vs. engagement letter
The audit charter, approved by the board or audit committee, defines the function's purpose, authority, responsibility and reporting line; an engagement letter defines one assignment's objectives, scope and terms.
- Remember
- Authority to access records and people comes from the charter.
- Tested as
- Questions ask which document gives the auditor authority or should be reviewed when access is refused.
- Trap
- Thinking IT management approves the charter; that would undermine independence.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Compliance testing vs. substantive testing
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Compliance testing | Tests whether a control operated as designed during the period under review | Conclusion is about the control, often expressed as a deviation rate | Treating a passed compliance test as proof the underlying data is accurate |
| Substantive testing | Tests the completeness, accuracy and validity of actual transactions, balances or data | Conclusion is about the data or value, often monetary | Skipping it entirely after good compliance results instead of reducing its extent |
Attribute vs. variable vs. stop-or-go vs. discovery sampling
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Attribute sampling | Estimates the rate at which a characteristic occurs in a population | Yes-or-no outcome per item; supports compliance tests | Using it to project a monetary misstatement |
| Variable sampling | Estimates a numeric value such as total dollar error | Measures quantity, not frequency; supports substantive tests | Choosing it for control-approval checks |
| Stop-or-go sampling | Attribute approach that allows testing to stop once early results support the conclusion | Prevents excessive sampling when few errors are expected | Using it where a high error rate is expected, which forces the full sample anyway |
| Discovery sampling | Attribute approach designed to find at least one instance of a rare event | Answers whether an occurrence exists, typically in fraud work | Treating its result as an error-rate estimate |
Inherent risk vs. control risk vs. detection risk
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Inherent risk | Susceptibility to material error before considering controls | Set by the nature of the business, system or transaction | Thinking good controls reduce inherent risk; they reduce control risk |
| Control risk | Risk that controls will not prevent or detect a material error in time | Depends on the design and operation of the auditee's controls | Believing the auditor can lower it by testing more |
| Detection risk | Risk that the auditor's procedures fail to detect a material error | The only component the auditor directly controls | Accepting the same detection risk regardless of how high the other two are |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Fixing instead of reporting
- What candidates pick
- The option where the auditor corrects the configuration or writes the missing procedure.
- Why it looks right
- It solves the problem immediately, and many candidates come from operational roles where that is the right instinct.
- Why it's wrong
- The auditor's job is to provide independent assurance; operating or designing the control creates a self-review threat over future audits.
Clue to watch for The question asks what the IS auditor should do; look for report, recommend, or discuss with management.
-
Removing a corrected finding
- What candidates pick
- Omit the issue from the report because the auditee fixed it during fieldwork.
- Why it looks right
- It seems fair to the auditee, and the risk appears to be gone.
- Why it's wrong
- The weakness existed during the period under review, and readers of the report need to know about it; the correction is noted alongside the finding.
Clue to watch for Phrases such as already corrected or fixed before the report point to reporting the finding with its remediation status.
-
Testing before understanding
- What candidates pick
- Start sampling transactions or running analytics as the first step.
- Why it looks right
- Testing produces tangible evidence and feels productive.
- Why it's wrong
- Without understanding the business process and its risks, the auditor cannot know which controls matter or what to test.
Clue to watch for FIRST in a planning scenario usually points to understanding the business, reviewing prior audits, or performing a risk assessment.
-
Trusting the auditee's report
- What candidates pick
- Rely on a system report or spreadsheet supplied by the process owner as the primary evidence.
- Why it looks right
- It is complete, convenient and comes from the system.
- Why it's wrong
- Auditee-prepared evidence can be filtered or altered; the auditor should generate or reconcile it independently.
Clue to watch for Look for an option where the auditor obtains the data directly or reperforms the control.
-
Silent scope reduction
- What candidates pick
- Narrow the scope to meet the deadline or work around a system the auditee will not provide access to.
- Why it looks right
- It keeps the engagement on schedule and avoids conflict.
- Why it's wrong
- An undisclosed limitation makes the opinion misleading; it must be escalated and, if unresolved, disclosed in the report.
Clue to watch for Words like denied access, restricted or not enough time signal escalation and disclosure of a scope limitation.
-
Over-rating CSA
- What candidates pick
- Treat control self-assessment as a replacement for independent audit.
- Why it looks right
- CSA involves the people closest to the controls and is cheaper.
- Why it's wrong
- CSA improves business ownership and early detection, but results are not independent and still need audit validation.
Clue to watch for If the question asks for the PRIMARY benefit of CSA, look for business ownership or early detection, not reduced audit responsibility.
Answer framework
For an IS auditing process question, locate yourself in the engagement and protect the auditor's role before choosing an action.
- Identify the engagement phase the scenario describes: planning, fieldwork, reporting or follow-up, and discard options that belong to a different phase.
- Check whether any option would have the auditor design, implement or operate a control, and remove it unless the scenario is explicitly advisory.
- Ask whether enough is known about the business, risks and controls to act; if not, the answer gathers understanding or evidence first.
- When comparing evidence or tests, prefer independent, auditor-obtained, objective sources and match the test type to the objective.
- For reporting choices, include supported findings with management responses, escalate material issues to the audit committee, and plan follow-up rather than accepting verbal assurances.
Practice question
Want more like this? The CISA practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the planning half: independence and the charter, then the audit risk model and risk-based planning, then control types. These ideas are the lens for every later question, so learn them as reasoning rules rather than definitions. Next work through execution in the order an engagement runs: project management, testing and sampling, evidence, analytics, reporting and quality assurance.
Give extra time to sampling and evidence. Candidates underestimate how precisely the exam separates attribute from variable sampling, compliance from substantive tests, and auditor-obtained from auditee-supplied evidence. Build a one-page table that links each test objective to its test type, sampling method and strongest evidence, and rehearse it until you can apply it to a new scenario.
Reporting is the other underestimated area. Practice deciding what happens to a finding when management disagrees, when the issue is fixed during fieldwork, and when a scope limitation appears.
After studying, do timed sets of mixed questions and review every wrong answer by asking two things: which engagement phase the scenario was in, and whether your choice kept the auditor in an assurance role. Then revisit this domain briefly before each of the other four, because their questions reuse its logic.
FAQ
How many Domain 1 questions are on the CISA exam?
ISACA publishes the weight (18%) but not a per-domain count. Applying 18% to the 150 questions gives a planning estimate of about 27, and the actual number may differ.
Do I need to memorize ISACA standard numbers?
The exam tests how standards apply, such as independence, evidence and reporting duties, rather than recall of standard numbers. Focus on what each standard requires of the auditor in a scenario.
Is there math in the sampling questions?
Expect conceptual questions on which sampling method fits and how sample size changes, rather than statistical formulas. Know the direction of each driver: confidence, tolerable error and expected error.
What is the difference between an audit and a control self-assessment?
An audit gives an independent conclusion against defined criteria. A control self-assessment is run by the business to evaluate its own controls; it builds ownership and finds issues earlier but does not replace independent assurance.
Can an IS auditor advise on a system that will later be audited?
Yes, providing advice on control requirements during a project is generally acceptable if the auditor does not make management decisions or build the controls. Taking an operational role is what impairs independence.
Why does this domain matter if it is only 18% of the exam?
Its rules on sequencing, evidence and the auditor's role decide many questions in Domains 2 to 5, where the question still asks what the IS auditor should do.
How long should I spend on Domain 1?
A planning estimate is 30 to 40 hours of a roughly 200-hour plan, with more if you have no audit background. Treat this as a guide rather than an official figure.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 1 knowledge
Check whether you can match sampling methods to test objectives, rank evidence by reliability, and keep the auditor's role intact under pressure.