Information System Auditing Process

• Develop and implement a risk-based IT audit strategy
• Plan specific audits
• Conduct audits in accordance with IT audit standards
• Report audit findings and make recommendations to key stakeholders
• Conduct follow-ups or prepare status reports

Governance and Management of IT

• Evaluate the effectiveness of the IT governance structure
• Evaluate IT organizational structure and human resources (personnel) management
• Evaluate the organization’s IT policies, standards, and procedures
• Evaluate the adequacy of the quality management system
• Evaluate IT management and monitoring of controls
• Evaluate IT contracting strategies and policies, and contract management practices
• Evaluate risk management practices
• Evaluate the organization’s business continuity plan

Information Systems Acquisition, Development and Implementation

• Evaluate the business case for proposed investments in information
• Evaluate the project management practices and controls
• Conduct reviews to determine whether a project is progressing in accordance with project plans
• Evaluate controls for information systems
• Evaluate the readiness of information systems for implementation and migration into production
• Conduct post implementation reviews of systems

Information Systems Operations and Business Resilience

• Conduct periodic reviews of information systems
• Evaluate service level management practices
• Evaluate third-party management practices
• Evaluate data administration practices
• Evaluate the use of capacity and performance monitoring tools and techniques
• Evaluate change, configuration, and release management practices

Protection of Information Assets

• Evaluate the information security policies, standards and procedures
• Evaluate the design, implementation, and monitoring of system and logical security
• Evaluate the design, implementation, and monitoring of physical access and environmental controls
• Evaluate the processes and procedures used to store, retrieve, transport, and dispose of information assets

How many people hold the CISA?

Since its inception, more than 140,000 people have obtained ISACA Certified Information Systems Auditor (CISA) certification to validate their expertise in understanding and performing vital roles within their job practice.

Are there any pre-requisites to take an exam?

There are no pre-requisites to take an ISACA CISM exam. However, there are experience requirements to become certified after passing the exam. You need a minimum of 5 years of professional information systems auditing, control or security work experience (as described in the CISA job practice areas) for certification.

What are the differences between CISA and CISM?

CISA certification is for auditors and the CISM is for information security managers and risk managers. The CISA is for auditors, particularly those who practice their art. The key difference is the CISA is for those “hands-on” auditors, while the CISM is for managers of hands-on information security specialists.

The CISA certification, as its name implies, is about the audit of information systems. The CISA knowledge can provide you with a deeper insight into information systems aspects that can make it easier for you to identify vulnerabilities that can compromise information stored/processed by information systems, adding more value to your audit work.  A candidate needs to accumulate 5 years of relevant experience to get the certification. Those who hold degrees in related fields or experience in similar industries might be able to chop off a year or two of the required five years of mandatory experience.

Exam:

Certified Information Systems Auditor - CISA

Duration:

240 minutes

Questions:

150 questions

Passing Score:

450/800

Information System Auditing Process (21%) Governance and Management of IT (17%) Information Systems Acquisition, Development, and Implementation (12%) Information Systems Operations and Business Resilience (23%) Protection of Information Assets (27%)

As the world becomes more technologically advanced across all sectors, CISA professionals are in higher demand to ensure information systems are working properly and aren’t compromised. Our team can deliver ISACA CISA certification training on-site, anywhere in the world, and can be tailored to fit your organization’s specific needs.

Learn more about our Enterprise Solutions here