# CISA Overview and IS Audit Basics

> Chapter 1 of the Courseiva ISACA-CISA curriculum — https://courseiva.com/learn/isaca-cisa/cisa-overview-and-is-audit-basics

**Official objective:** 1.1 — Describe the purpose and scope of IS auditing and the CISA certification.

## Introduction

An IS audit is an independent check of a company's technology systems to find weaknesses and ensure they protect data properly. It exists because companies rely on computers, networks, and software to run their business, and those systems can fail, be hacked, or be misused without anyone noticing. For someone studying for the CISA exam, understanding this core definition is the foundation for everything else — it is the single most important concept that ties together all five exam domains.

## The Home Inspection Analogy

A home inspection is a thorough, independent review of a house to protect the buyer's investment and ensure the property meets agreed standards.

You are buying your first home. You find one you love online, but you cannot just hand over your savings without checking it is actually worth what the seller claims. You hire a certified home inspector. This inspector is not the builder, not the seller, and not your real estate agent — they are an independent third party. Their job is to inspect the electrical wiring, the plumbing, the roof, the foundation, and even the attic for hidden problems. They test outlets, run the taps, check for cracks, and look for pests. They produce a detailed written report listing everything they found — from a loose doorknob to a leaking water heater. This report is not meant to make the house look bad; it is meant to give you a complete, honest picture so you can negotiate repairs, adjust the price, or even walk away.

Now imagine that the house is a company's IT systems. The home inspector is the IT auditor. The inspection report is the audit finding. The building code is the set of rules and regulations the company must follow, like financial reporting standards or data privacy laws. The seller's promise that the roof is new is like a company claiming its cybersecurity is 'excellent'. Without an independent inspection, you never know if that promise is true. The CISA certification is like a license that proves the inspector has the training and ethics to do the job properly. This analogy shows exactly what an IS audit does: it provides an independent, objective check on a company's technology controls to protect anyone who relies on that company's systems.

## Core explanation

An Information Systems (IS) audit is the process of collecting and evaluating evidence to determine whether a company's computer systems are protecting its assets, maintaining data integrity, and operating effectively to achieve the organisation's goals. Let us break down every part of that definition.

First, 'information systems' refers to the entire set of technology components a business uses: servers, databases, networks, laptops, software applications, and even the people who operate them. When an IS auditor walks into a company, they look at all of these pieces together, not just one device.

Second, 'collecting and evaluating evidence' means the auditor does not guess or rely on what people tell them. They gather actual proof: they examine system logs, check configuration settings, interview employees, watch processes in action, and review documents. Evidence is the hard data that supports a conclusion. If a manager says 'we backup our data every night', the auditor asks to see the backup logs and test a restore.

Third, 'protecting assets' refers to security. Assets are anything valuable the company owns — customer data, intellectual property like product designs, financial records, and the hardware itself (servers, routers, laptops). An IS auditor checks whether these assets are safe from unauthorised access, theft, or damage. This requires things like firewalls, encryption, and password policies.

Fourth, 'maintaining data integrity' means ensuring the data is accurate, complete, and has not been tampered with. If a bank's database shows you have £1,000 in your account, the auditor verifies that number cannot easily be changed by an employee or an attacker without authorisation. Integrity is about trust in the information.

Fifth, 'operating effectively' means the systems actually do what they are supposed to do. If a company builds a website that takes ten seconds to load, it is not effective, even if it is secure. Auditors check that systems meet performance goals and are available when needed. This is called 'efficiency and effectiveness'.

Why does this exist? Before the age of computers, audits existed for financial records — accountants would check paper ledgers for errors or fraud. As businesses moved their operations to computers, they needed a new kind of expert who understood both business processes and technology. That is the IS auditor. The IS audit replaces guesswork and assumption with facts. Without it, a company's board of directors, investors, regulators, and customers would have no way to know whether the company's technology is trustworthy.

The purpose of an IS audit serves multiple stakeholders:

- Management uses audit findings to improve operations and reduce risks.
- The board of directors uses them to fulfil their governance responsibilities.
- Regulators (like financial authorities or data protection agencies) use them to ensure compliance with laws.
- External parties like customers and business partners use audit results to decide whether to trust the organisation.

A CISA is a Certified Information Systems Auditor. This credential is awarded by ISACA, a global professional association. To earn the CISA, a candidate must pass a rigorous exam covering five domains: Information System Auditing Process; Governance and Management of IT; Information Systems Acquisition, Development, and Implementation; Information Systems Operations and Business Resilience; and Protection of Information Assets. The CISA certification tells employers that the holder has demonstrated knowledge of IS auditing standards, practices, and principles.

An IS auditor follows a standard process known as the audit lifecycle:

1. Planning: The auditor defines the scope (what will be examined), the objectives (what questions to answer), and the resources needed. They also perform a risk assessment to focus on the most critical areas.
2. Evidence gathering: The auditor collects data through interviews, observation, inspection of documents, and testing of controls.
3. Evaluation: The auditor compares the evidence against criteria (laws, regulations, policies, or industry best practices) to reach conclusions.
4. Reporting: The auditor documents findings, including any deficiencies or weaknesses, and communicates them to management in a formal audit report.
5. Follow-up: The auditor later checks whether management has fixed the identified weaknesses.

The CISA exam specifically tests whether you understand this lifecycle, the standards (such as ISACA's IS Audit Standards), and the mindset of an independent, objective evaluator. It is not a technical engineering exam — you do not need to build a network. You need to think like a reviewer who asks 'does this control work as intended?'

## Real-world context

Sarah is a newly hired IT auditor at a mid-sized retail company called ShopDirect. The company processes online orders for thousands of customers daily. The chief information officer (CIO) has just informed the board that ShopDirect's payment system is 'fully secure'. The board wants independent verification before the annual financial report is published. This is where Sarah begins her first IS audit.

Sarah starts by planning the audit. She meets with the internal audit manager to define the scope: the payment processing system and all related data flows. She identifies key risks — credit card data could be stolen, fraudulent transactions could go undetected, or system downtime could stop all sales. She reviews the company's policies and procedures for payment processing. She then schedules interviews with the IT team, including the database administrator and the network security lead.

Next, Sarah gathers evidence. She requests a list of all users with administrative access to the payment database. She checks the firewall logs to see if any unauthorised IP addresses attempted to connect. She observes a payment transaction from end to end by asking a developer to walk her through the code. She also tests a critical control: whether all credit card numbers are encrypted at rest (stored) and in transit (being sent). She records every step in her work papers.

During evidence gathering, Sarah discovers something concerning. The encryption key for the payment database is stored in a plain text file on the same server. Any employee who logs into that server could read it. This is a major weakness. She also finds that the company does not run automated vulnerability scans on the payment application — meaning new security holes could exist for months without anyone noticing.

Sarah evaluates these findings against ISACA's IS Audit Standards and the Payment Card Industry Data Security Standard (PCI DSS), which ShopDirect must follow to accept credit cards. Both standards require encryption keys to be stored securely and regular vulnerability scans to be performed. She documents that the company is non-compliant.

Sarah writes the audit report. She presents her findings clearly, ranking each by severity (high, medium, low). The high-risk finding about the plain text encryption key gets the most attention. She recommends immediate actions: move the encryption key to a hardware security module (HSM), implement a key rotation policy, and schedule monthly vulnerability scans. She shares the draft report with IT management to confirm factual accuracy before issuing the final version.

Finally, Sarah follows up. Two months later, she requests evidence that the changes were made. The IT team shows her the HSM logs and a schedule of completed scans. Sarah verifies the evidence and closes the finding. The board now has proof that the payment system is more secure than it was before.

What an IT professional actually does with this includes:

- Reviewing system configurations against a checklist of security best practices.
- Interviewing staff to understand processes that are not written down anywhere.
- Testing controls by attempting to exploit a vulnerability (under controlled conditions).
- Drafting reports that translate technical issues into business risks for non-technical managers.
- Collaborating with IT teams to agree on remediation deadlines without compromising independence.

## Exam focus

The CISA exam tests Chapter 1 objectives primarily through scenario-based questions in Domain 1 (Information System Auditing Process). You will not be asked to simply define an IS audit. Instead, you will be given a short business situation and asked to choose the best action an auditor should take. The exam loves to test your understanding of the IS audit lifecycle, the role of independence, and the difference between an auditor's responsibilities and management's responsibilities.

Specific concepts that appear frequently:

- The five phases of the audit process: planning, evidence gathering, evaluation, reporting, and follow-up. You must know the order and what happens in each phase.
- The definition of 'audit risk' and its three components: inherent risk (risk before controls), control risk (risk that controls will not prevent or detect a problem), and detection risk (risk the auditor will miss a finding).
- The 'three lines of defence' model: first line (operational management), second line (risk and compliance functions), third line (internal audit). The CISA is part of the third line.
- The importance of auditor independence — both in fact (truly unbiased) and in appearance (looking unbiased). If an auditor has any financial or personal relationship with the area being audited, they must recuse themselves.
- The difference between a 'control' (something that reduces risk) and a 'finding' (a problem identified by the audit).
- The role of 'risk assessment' in audit planning — you focus on high-risk areas, not everything equally.

Common traps the exam sets:

- 'The auditor should implement the fix' — wrong. Auditors identify problems; management implements solutions. Implementing the fix destroys independence.
- 'The auditor should accept the manager's verbal assurance' — wrong. Auditors must collect evidence, not rely on claims.
- 'The auditor should expand the scope to include everything' — wrong. Scope is defined in the planning phase and should be focused on high-risk areas.
- 'The auditor should ignore a minor finding' — wrong. All findings must be documented, but they are prioritised by severity.
- Confusing 'compliance audit' (checks adherence to laws) with 'operational audit' (checks efficiency and effectiveness). The CISA covers both, but the exam will test which applies to a given scenario.

Key definitions to memorise exactly:

- Audit objective: what the audit aims to achieve.
- Audit scope: the boundaries of the audit (which systems, locations, processes).
- Audit evidence: information used to support audit conclusions. Must be sufficient, reliable, and relevant.
- Control: a policy, procedure, or technical mechanism that reduces risk.
- Finding: a gap or deficiency identified by comparing evidence against criteria.
- Recommendation: a proposed action to address a finding.
- Follow-up: the process of verifying that management has implemented recommendations.

The exam will also ask about the different types of IS audits: compliance audit (does the organisation follow laws and regulations?), financial audit related to IT (does the IT system support accurate financial reporting?), operational audit (is the system efficient and effective?), and integrated audit (combining financial and IT audits). You must be able to distinguish these based on the scenario.

The most frequently tested overarching principle is this: an IS auditor provides independent assurance. They do not manage, they do not implement, they do not decide on risk appetite. They report what they find and leave action to management.

## Step by step

1. **Define Audit Objective and Scope** — The auditor works with the audit client to decide what the audit will cover (scope) and what questions it will answer (objectives). For example, 'audit the accounts payable system to verify that all payments are authorised'. This step prevents scope creep and ensures the audit is focused on high-risk areas.
2. **Perform Risk Assessment** — The auditor identifies and evaluates the risks that could threaten the achievement of the audit objectives. For example, in an accounts payable audit, a key risk might be that unauthorised employees can create fake vendors. This step determines where to concentrate evidence-gathering efforts.
3. **Gather Audit Evidence** — The auditor collects proof through interviews, document review, system observation, and testing of controls. In the accounts payable example, the auditor might request a list of all vendor records, test the approval workflow by creating a sample payment, and examine user access rights. Evidence must be documented in work papers.
4. **Evaluate Evidence Against Criteria** — The auditor compares the gathered evidence against a benchmark — such as a company policy, a law (like GDPR), or an industry standard (like PCI DSS). If the evidence shows that vendor records are not reviewed for duplicates, that is a finding. The auditor evaluates the severity and root cause of each gap.
5. **Report Findings and Make Recommendations** — The auditor writes an audit report that clearly states each finding, the criteria that were not met, the risk or impact, and a recommendation for corrective action. The report is shared with management and the board. For example: 'Finding: 15 vendor records have no taxpayer ID. Risk: potential fraudulent payments. Recommendation: require a valid ID for all new vendors.'
6. **Conduct Follow-Up** — After an agreed period, the auditor checks whether management has implemented the recommendations. They request evidence, such as updated procedures or system configuration logs. If the fix is verified, the finding is closed. If not, the auditor escalates the issue to higher levels of management.

## Comparisons

### Internal IS Auditor vs External IS Auditor

**Internal IS Auditor:**
- Employed by the organisation being audited.
- Reports to the audit committee or board of directors.
- Has ongoing, deep knowledge of the organisation's systems and culture.

**External IS Auditor:**
- Hired from an independent firm for a specific engagement.
- Reports directly to the client (e.g., board or regulatory body).
- Brings fresh perspective and comparative industry benchmarks.

### Compliance Audit vs Operational Audit

**Compliance Audit:**
- Focuses on adherence to laws, regulations, and policies.
- Checks 'are we following the rules?'
- Pass/fail outcome based on specific criteria (e.g., GDPR).

**Operational Audit:**
- Focuses on efficiency and effectiveness of processes.
- Checks 'are we doing things the best way?'
- Outcome includes recommendations for improvement, not just pass/fail.

### Audit Finding vs Audit Recommendation

**Audit Finding:**
- Identifies a gap or deficiency between evidence and criteria.
- Describes what is wrong and why it matters.
- Example: 'No password policy exists for the HR database.'

**Audit Recommendation:**
- Proposes a specific action to address the finding.
- Describes how to fix the problem.
- Example: 'Implement a password policy requiring 12 characters and MFA.'

### Control vs Risk

**Control:**
- A measure that reduces the likelihood or impact of a risk.
- Can be preventive (stops the problem) or detective (finds the problem).
- Example: A firewall is a preventive control against network attacks.

**Risk:**
- The possibility of an event that could harm the organisation.
- Measured as likelihood multiplied by impact.
- Example: The risk of a data breach due to weak network security.

## Diagram

_The five phases of the IS audit lifecycle, showing the cyclical nature and key stakeholders involved at different stages._

```mermaid
flowchart TD
    A[IS Audit Lifecycle] --> B[1. Planning]
    B --> C[2. Evidence Gathering]
    C --> D[3. Evaluation]
    D --> E[4. Reporting]
    E --> F[5. Follow-Up]
    F --> B
    G[Stakeholders] --> A
    H[Management] --> B
    I[Audit Committee] --> E
```

## Common misconceptions

- **Misconception:** An IS auditor is the same as a cybersecurity hacker or a penetration tester who breaks into systems. **Reality:** An IS auditor evaluates controls and processes; a penetration tester actively exploits vulnerabilities. Auditors rarely perform actual attacks. (Both roles involve technology and security, so beginners group them together. But the CISA focus is on governance, process, and compliance, not on technical exploitation.)
- **Misconception:** If a company passes an IS audit, it means the company is completely secure and will never be hacked. **Reality:** An IS audit provides assurance at a point in time and within a defined scope. It does not guarantee future security or cover everything in the organisation. (People want a simple pass/fail answer. Audits are more nuanced — they assess specific controls against specific criteria, and new risks emerge constantly.)
- **Misconception:** The IS auditor is responsible for fixing the problems they find during the audit. **Reality:** The auditor identifies and reports problems. Management is responsible for implementing corrective actions. (If the auditor fixes the problem, they lose independence and cannot objectively review the same control later. This is a core principle the CISA exam constantly tests.)
- **Misconception:** CISA certification is only for people who work in IT departments. **Reality:** CISA is valuable for any professional involved in governance, risk, or compliance, including internal auditors, external auditors, compliance officers, and risk managers. (The name 'Information Systems Auditor' sounds very technical, but the job is heavily focused on business processes and controls, which attract people from accounting, law, and management backgrounds.)
- **Misconception:** All IS audits follow the exact same steps regardless of the organisation being audited. **Reality:** The audit lifecycle is standard, but the specific procedures, evidence, and criteria vary based on the organisation's industry, size, regulatory environment, and risk profile. (Beginners want a rigid checklist. In reality, professional judgement and risk assessment drive how an auditor plans and executes each unique engagement.)

## Key takeaways

- An IS audit is an independent, objective assurance activity that evaluates whether an organisation's information systems protect assets, maintain data integrity, and operate effectively.
- The CISA certification is awarded by ISACA and validates a professional's expertise in auditing, controlling, and securing information systems.
- The five phases of the IS audit process are planning, evidence gathering, evaluation, reporting, and follow-up.
- Auditor independence — both in fact and in appearance — is non-negotiable; an auditor who implements fixes or has a conflict of interest cannot be objective.
- Audit evidence must be sufficient, reliable, and relevant; verbal assurances from management are not acceptable evidence.
- An IS audit provides assurance at a specific point in time and within a defined scope; it does not guarantee perfect security or cover every system.
- The three lines of defence model places internal audit (including IS audit) in the third line, separate from operational management and risk/compliance functions.
- The CISA exam tests your ability to apply audit principles to real-world scenarios, not just memorise definitions.

## FAQ

**Do I need a technical background to become a CISA and pass the exam?**

No, but you need to understand basic IT concepts like networks, databases, and operating systems. The CISA exam focuses on audit and control, not on writing code or building systems. Many successful CISAs come from accounting, finance, or business backgrounds.

**What is the difference between an internal IS auditor and an external IS auditor?**

An internal auditor is employed by the organisation they audit and reports to the board or audit committee. An external auditor is an independent contractor or from a consulting firm hired to perform a specific audit. Both must maintain independence, but external auditors have no ongoing employment relationship.

**How many times can I take the CISA exam?**

You can take the CISA exam up to four times in a rolling 12-month period. There is no lifetime limit, but you must wait at least 30 days between attempts. Each attempt requires a new registration fee.

**What happens if I pass the CISA exam but do not have the required five years of work experience?**

You can become an 'CISA candidate' and have up to five years to accumulate the required experience. ISACA offers some experience waivers for certain degrees (e.g., a maximum of one year waiver for a four-year degree).

**Is the CISA exam only about IT auditing, or does it cover cybersecurity?**

The CISA exam covers cybersecurity as part of Domain 5 (Protection of Information Assets), but it is not a deep technical security exam. The focus is on controls and governance around security, not on how to hack or defend systems. The CISM (Certified Information Security Manager) is more security-focused.

**What is the pass mark for the CISA exam?**

The passing score is 450 on a scale of 200 to 800. You need to answer approximately 56-60% of the 150 questions correctly. The exact cut score varies slightly per exam form because of statistical equating.

## Check your understanding

1. **What is the primary purpose of an IS audit?**

   Answer: To provide independent, objective assurance that an organisation's information systems protect assets, maintain data integrity, and operate effectively.

2. **Name the five phases of the IS audit process in order.**

   Answer: Planning, evidence gathering, evaluation, reporting, and follow-up.

3. **Why must an IS auditor never implement the fixes they recommend?**

   Answer: To maintain independence; if the auditor implements the fix, they cannot later objectively audit the same control, which compromises the integrity of future audits.

4. **What is the difference between a compliance audit and an operational audit?**

   Answer: A compliance audit checks whether the organisation follows laws, regulations, and policies; an operational audit evaluates whether processes are efficient and effective.

5. **What three characteristics must audit evidence have to be valid?**

   Answer: It must be sufficient (enough quantity), reliable (from a trustworthy source), and relevant (directly related to the audit objective).

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isaca-cisa/cisa-overview-and-is-audit-basics