Certified Information Systems Auditor (CISA)

CISA
Certification Exam Domains (2024 Syllabus)

Domain
1: Information System Auditing Process (21% of the exam)

• Perform a risk-based IS
  audit approach


• Plan audits by defining
  objectives, scope, and methodologies


• Conduct audit fieldwork
  (e.g., interviews, evidence collection, testing)


• Communicate audit findings
  and report results


• Follow up on audit
  outcomes and corrective actions


• Use data analytics in
  audit processes


• Implement quality
  assurance (QA) for audit functions

Domain
2: Governance and Management of IT (17%)

• Evaluate IT governance
  structure and alignment with enterprise governance


• Assess IT strategy and
  alignment with business objectives


• Monitor performance and
  compliance with IT policies and standards


• Evaluate IT organizational
  structure and human resources


• Manage IT-related risks
  and ensure compliance with regulatory requirements


• Ensure enterprise risk
  management (ERM) integration with IT

Domain
3: Information Systems Acquisition, Development, and Implementation (12%)

• Evaluate the business case
  for system development proposals


• Participate in project
  management processes


• Review controls in system
  development lifecycle (SDLC)


• Assess application
  controls (input, processing, output)


• Evaluate change control
  processes


• Review system
  implementation and migration plans


• Conduct
  post-implementation reviews

Domain
4: Information Systems Operations and Business Resilience (23%)

• Monitor system operations
  and use of resources


• Evaluate IT service
  management (ITSM) practices


• Assess third-party management
  (vendors, cloud services)


• Review disaster recovery
  and business continuity plans


• Evaluate backup and
  recovery processes


• Monitor incident
  management and problem resolution


• Ensure system resilience
  and availability

Domain
5: Protection of Information Assets (27%)

• Assess information
  security policies, standards, and procedures


• Evaluate identity and
  access management (IAM)


• Review encryption and data
  protection strategies


• Examine physical and
  environmental controls


• Assess network and
  endpoint security


• Monitor incident response
  and forensic investigation readiness


• Evaluate data
  classification and handling practices


• Ensure compliance with
  privacy laws and regulations