CISA Course

Lesson 1 • Risk and Control Concepts

This introduces inherent risk, control risk, and detection risk as foundational audit concepts. These concepts underpin risk-based audit planning covered in later chapters.

Lesson 2 • Audit Evidence and Documentation

This explains how auditors collect, evaluate, and document evidence to support findings. Proper documentation practices are required for every audit engagement.

Lesson 3 • Fundamentals of IS Auditing

This defines IS auditing, its purpose, and its relationship to organizational governance. This provides the conceptual lens through which all audit activities are interpreted.

Lesson 1 • Fieldwork Execution Techniques

This covers interviewing, observation, inspection, and re-performance as fieldwork methods. Effective execution ensures sufficient evidence to support audit conclusions.

Lesson 2 • Risk-Based Audit Planning

This applies risk assessment techniques to prioritize audit resources on high-risk areas. This builds directly on risk concepts introduced in Chapter 1.

Lesson 3 • Audit Reporting and Follow-Up

This structures audit findings, recommendations, and management responses into formal reports. Follow-up procedures verify that corrective actions are implemented.

Lesson 4 • Audit Program Development

This guides creation of detailed audit programs with specific test steps and objectives. Programs translate the audit plan into actionable fieldwork instructions.

Lesson 1 • IT Organizational Structures

This analyzes IT department structures, roles, and segregation of duties requirements. Proper structure reduces fraud risk and supports accountability.

Lesson 2 • Strategic IT Planning and Alignment

This evaluates how IT strategy supports business objectives and organizational mission. Misalignment between IT and business strategy is a key governance risk.

Lesson 3 • IT Governance Frameworks

This surveys major IT governance frameworks and their control objectives. Auditors use these frameworks as benchmarks when evaluating organizational governance.

Lesson 4 • IT Policies and Procedures

This reviews the hierarchy of IT policies, standards, and procedures as governance instruments. Auditors verify policy completeness, currency, and enforcement.

Lesson 1 • Agile and Alternative Development Methods

This examines control challenges unique to agile, DevOps, and rapid development approaches. Auditors must adapt traditional SDLC audit steps to iterative environments.

Lesson 2 • Project Management and Change Control

This assesses project governance, budget oversight, and formal change control processes. Weak project controls are a leading cause of system implementation failures.

Lesson 3 • Software Acquisition and Vendor Management

This evaluates controls over commercial software acquisition and third-party development. Vendor management controls reduce supply chain and contractual risks.

Lesson 4 • Application Controls and Testing

This distinguishes input, processing, and output controls embedded within applications. Application control testing validates data integrity throughout processing.

Lesson 1 • Business Continuity and Disaster Recovery

This audits BCP and DRP design, testing, and maintenance to verify recovery capability. Recovery controls directly affect organizational resilience and stakeholder confidence.

Lesson 2 • IT Operations Management Controls

This reviews job scheduling, batch processing, and operations monitoring controls. Operational controls ensure reliable and consistent IT service delivery.

Lesson 3 • Hardware and Infrastructure Management

This assesses physical and logical controls over servers, networks, and end-user devices. Infrastructure controls form the foundation of system availability and integrity.

Lesson 4 • Data Management and Storage Controls

This examines data classification, retention, backup, and media management controls. Proper data management protects information assets and supports recovery objectives.

Lesson 1 • Network and Infrastructure Security

This assesses perimeter defenses, network segmentation, and traffic monitoring controls. Network security controls prevent unauthorized access and lateral movement.

Lesson 2 • Physical and Environmental Security

This reviews data center access controls, environmental monitoring, and physical safeguards. Physical security failures can bypass all logical controls and cause data loss.

Lesson 3 • Logical Access Controls

This evaluates authentication, authorization, and access provisioning controls over systems. Logical access is the most frequently tested domain in IS security audits.

Lesson 4 • Information Security Governance

This examines security policies, roles, and governance structures that direct protection efforts. Security governance ensures accountability and consistent control application.

Lesson 5 • Security Incident Management

This audits incident detection, response, containment, and post-incident review processes. Effective incident management limits damage and supports regulatory obligations.

Lesson 1 • Cloud Computing Audit Considerations

This evaluates shared responsibility models, data residency, and cloud provider controls. Cloud adoption shifts traditional control boundaries and requires updated audit procedures.

Lesson 2 • Artificial Intelligence and Automation Risks

This identifies control risks in AI model development, training data, and automated decisions. AI introduces bias, explainability, and accountability challenges for auditors.

Lesson 3 • Big Data and Analytics Governance

This reviews data quality, lineage, and access controls in large-scale analytics environments. Governance gaps in big data platforms can compromise decision integrity.

Lesson 4 • Internet of Things Security Controls

This assesses device authentication, firmware management, and network segmentation for IoT. IoT expands the attack surface and introduces unique operational technology risks.

Lesson 1 • Integrated and Concurrent Auditing

This examines embedded audit modules and real-time monitoring as continuous assurance methods. Integrated auditing reduces the lag between control failure and detection.

Lesson 2 • CISA Exam Question Analysis

This deconstructs CISA question stems, distractors, and answer selection logic. Understanding question construction improves accuracy under timed exam conditions.

Lesson 3 • Final Review and Readiness Assessment

This conducts domain-by-domain knowledge gap analysis and targeted remediation planning. Readiness assessment ensures students enter the exam with confidence and full preparation.

Lesson 4 • Computer-Assisted Audit Techniques

This applies CAATs including data extraction, analysis scripts, and continuous auditing tools. CAATs increase audit coverage and efficiency across large data populations.