CISA Course

Lesson 1 • Risk and Control Concepts

Introduces inherent risk, control risk, and detection risk as foundational audit concepts. These concepts underpin risk-based audit planning covered in later chapters.

Lesson 2 • Audit Evidence and Documentation

Explains how auditors collect, evaluate, and document evidence to support findings. Proper documentation practices are required for every audit engagement.

Lesson 3 • Fundamentals of IS Auditing

Defines IS auditing, its purpose, and its relationship to organizational governance. Provides the conceptual lens through which all audit activities are interpreted.

Lesson 1 • Fieldwork Execution Techniques

Covers interviewing, observation, inspection, and re-performance as fieldwork methods. Effective execution ensures sufficient evidence to support audit conclusions.

Lesson 2 • Risk-Based Audit Planning

Applies risk assessment techniques to prioritize audit resources on high-risk areas. Builds directly on risk concepts introduced in Chapter 1.

Lesson 3 • Audit Reporting and Follow-Up

Structures audit findings, recommendations, and management responses into formal reports. Follow-up procedures verify that corrective actions are implemented.

Lesson 4 • Audit Program Development

Guides creation of detailed audit programs with specific test steps and objectives. Programs translate the audit plan into actionable fieldwork instructions.

Lesson 1 • IT Organizational Structures

Analyzes IT department structures, roles, and segregation of duties requirements. Proper structure reduces fraud risk and supports accountability.

Lesson 2 • Strategic IT Planning and Alignment

Evaluates how IT strategy supports business objectives and organizational mission. Misalignment between IT and business strategy is a key governance risk.

Lesson 3 • IT Governance Frameworks

Surveys major IT governance frameworks and their control objectives. Auditors use these frameworks as benchmarks when evaluating organizational governance.

Lesson 4 • IT Policies and Procedures

Reviews the hierarchy of IT policies, standards, and procedures as governance instruments. Auditors verify policy completeness, currency, and enforcement.

Lesson 1 • Agile and Alternative Development Methods

Examines control challenges unique to agile, DevOps, and rapid development approaches. Auditors must adapt traditional SDLC audit steps to iterative environments.

Lesson 2 • Project Management and Change Control

Assesses project governance, budget oversight, and formal change control processes. Weak project controls are a leading cause of system implementation failures.

Lesson 3 • Software Acquisition and Vendor Management

Evaluates controls over commercial software acquisition and third-party development. Vendor management controls reduce supply chain and contractual risks.

Lesson 4 • Application Controls and Testing

Distinguishes input, processing, and output controls embedded within applications. Application control testing validates data integrity throughout processing.

Lesson 1 • Business Continuity and Disaster Recovery

Audits BCP and DRP design, testing, and maintenance to verify recovery capability. Recovery controls directly affect organizational resilience and stakeholder confidence.

Lesson 2 • IT Operations Management Controls

Reviews job scheduling, batch processing, and operations monitoring controls. Operational controls ensure reliable and consistent IT service delivery.

Lesson 3 • Hardware and Infrastructure Management

Assesses physical and logical controls over servers, networks, and end-user devices. Infrastructure controls form the foundation of system availability and integrity.

Lesson 4 • Data Management and Storage Controls

Examines data classification, retention, backup, and media management controls. Proper data management protects information assets and supports recovery objectives.

Lesson 1 • Network and Infrastructure Security

Assesses perimeter defenses, network segmentation, and traffic monitoring controls. Network security controls prevent unauthorized access and lateral movement.

Lesson 2 • Physical and Environmental Security

Reviews data center access controls, environmental monitoring, and physical safeguards. Physical security failures can bypass all logical controls and cause data loss.

Lesson 3 • Logical Access Controls

Evaluates authentication, authorization, and access provisioning controls over systems. Logical access is the most frequently tested domain in IS security audits.

Lesson 4 • Information Security Governance

Examines security policies, roles, and governance structures that direct protection efforts. Security governance ensures accountability and consistent control application.

Lesson 5 • Security Incident Management

Audits incident detection, response, containment, and post-incident review processes. Effective incident management limits damage and supports regulatory obligations.

Lesson 1 • Cloud Computing Audit Considerations

Evaluates shared responsibility models, data residency, and cloud provider controls. Cloud adoption shifts traditional control boundaries and requires updated audit procedures.

Lesson 2 • Artificial Intelligence and Automation Risks

Identifies control risks in AI model development, training data, and automated decisions. AI introduces bias, explainability, and accountability challenges for auditors.

Lesson 3 • Big Data and Analytics Governance

Reviews data quality, lineage, and access controls in large-scale analytics environments. Governance gaps in big data platforms can compromise decision integrity.

Lesson 4 • Internet of Things Security Controls

Assesses device authentication, firmware management, and network segmentation for IoT. IoT expands the attack surface and introduces unique operational technology risks.

Lesson 1 • Integrated and Concurrent Auditing

Examines embedded audit modules and real-time monitoring as continuous assurance methods. Integrated auditing reduces the lag between control failure and detection.

Lesson 2 • CISA Exam Question Analysis

Deconstructs CISA question stems, distractors, and answer selection logic. Understanding question construction improves accuracy under timed exam conditions.

Lesson 3 • Final Review and Readiness Assessment

Conducts domain-by-domain knowledge gap analysis and targeted remediation planning. Readiness assessment ensures students enter the exam with confidence and full preparation.

Lesson 4 • Computer-Assisted Audit Techniques

Applies CAATs including data extraction, analysis scripts, and continuous auditing tools. CAATs increase audit coverage and efficiency across large data populations.