Learning Objectives

• Assess organizational policies, procedures, and infrastructures to verify that information systems are adequately controlled and support business objectives
• Apply risk management principles and governance frameworks within the context of information systems auditing
• Implement security measures that effectively protect information assets
• Understand and work within IS audit standards, guidelines, and codes of ethics
• Build competencies in audit project management, evidence collection, and data analytics
• Evaluate IT governance structures, strategies, and management practices
• Review information systems acquisition, development, and implementation processes
• Analyze information systems operations and organizational resilience strategies
• Apply frameworks, standards, and guidelines related to information asset security
• Prepare thoroughly to pass the CISA certification exam

Course Outline

Module Domain 1: The Information Systems Auditing Process

Planning topics include IS Audit Standards, Guidelines and Codes of Ethics, Business Process Types of Controls, Risk-based Audit Planning, and Types of Audits and Assessments. Execution topics include Audit Project Management, Sampling Methodology, Audit Evidence Collection Techniques, Data Analytics, Reporting and Communication Techniques, and Quality Assurance and Improvement of the Audit Process.

Module Domain 2: IT Governance and Management

IT Governance and IT Strategy topics include IT-related Frameworks, IT Standards, Policies and Procedures, Organizational Structure, Enterprise Architecture, Enterprise Risk Management, Maturity Models, and Laws, Regulations and Industry Standards Affecting the Organization. IT Management topics include IT Resource Management, IT Service Provider Acquisition and Management, IT Performance Monitoring and Reporting, and Quality Assurance and Quality Management of IT.

Module Domain 3: Acquisition, Development, and Implementation of Information Systems

Information Systems Acquisition and Development topics include Project Governance and Management, Business Case and Feasibility Analysis, System Development Methodologies, and Control Identification and Design. Information Systems Implementation topics include Testing Methodologies, Configuration and Release Management, System Migration, Infrastructure Deployment and Data Conversion, and Post-implementation Review.

Module Domain 4: Information Systems Operations and Organizational Resilience

Information Systems Operations topics include Common Technology Components, IT Asset Management, Job Scheduling and Production Process Automation, System Interfaces, End-user Computing, Data Governance, Systems Performance Management, Problem and Incident Management, Change/Configuration/Release and Patch Management, IT Service Level Management, Database Management, and Control Identification and Design. Business Resilience topics include Business Impact Analysis, System Resiliency, Data Backup/Storage and Restoration, Business Continuity Plan, and Disaster Recovery Plans.

Module Domain 5: Protection of Information Assets

Information Asset Security Frameworks, Standards and Guidelines topics include Privacy Principles, Physical Access and Environmental Controls, Identity and Access Management, Network and End-point Security, Data Classification, Data Encryption and Encryption-related Techniques, and Public Key Infrastructure. Security Event Management topics include Security Awareness Training and Programs, Information System Attack Methods and Techniques, Security Testing Tools and Techniques, Security Monitoring Tools and Techniques, Incident Response Management, and Evidence Collection and Forensics.