CISA Refresher 6 Flashcards
Audit Charter
document that states management’s objectives for and delegation of authority to IS audit. Should be approved at the highest levels of management, and should outline the overall authority scope, and responsibilities of the audit function. Should not significantly change over time.
Engagement Letter
a letter that formalizes the contract between the auditor and the client and outlines the responsibilities of both parties; focused on a particular audit exercise that is sought to be initiated in an organization with a specific objective in mind
Audit Plan
A list of the audit procedures the auditors need to perform to gather sufficient appropriate evidence on which to base their opinion on the financial statements; consists of both short-term and long-term planning
Sarbanes-Oxley Act of 2002
Law that requires companies to maintain adequate systems of internal control
Professional Independence
In all matters related to the audit, the IS auditor should be independent of the auditee in both attitude and appearance
Organizational Independence
The IS audit function should be independent of the area or activity being reviewed to permit objective completion of the audit assignment
Audit Risk
the risk that information may contain a material error that may go undetected during the course of the audit
Error Risk
the risk of errors occurring in the area being audited
Information Technology Assurance Framework (ITAF)
provides an integrated process (involving technical and non-technical aspects) for developing and deploying IT systems with intrinsic and appropriate security measures in order to meet the organizations mission
General standards
standards that establish the guiding principles under which the IT assurance profession operates; they apply to the conduct of all assignments, and deal with the IT audit and assurance professional’s ethics, independence, objectivity and due care, as well as knowledge, competency and skill
Performance standards
standards that establish baseline expectations in the conduct of IT assurance engagements; focused on the design of the assurance work, the conduct of the assurance, the evidence required, and the development of assurance and audit findings and conclusions
Reporting standards
standards that address the types of audit reports, means of communication, and information to be communicated at the conclusion of an audit
Risk analysis
part of audit planning, and helps identify risks and vulnerabilities so the IS auditor can determine the controls needed to mitigate those risks
Risk
the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization; the combination of the probability of an event and its consequence
Business Risk
a risk that may negatively impact the assets, processes or objectives of a specific business or organization
IT Risk
the risk associated with the use, ownership, operation, involvement, influence, and adoption of IT within an enterprise
Risk Assessment Process
- Identify Business Objectives
Internal controls
normally composed of policies, procedures, practices and organizational structures which are implemented to reduce risk to the organization; developed to provide reasonable assurance to management that the organization’s business objectives will be achieved and risk events will be prevented, or detected and corrected
Preventive controls
Controls that deter control problems before they occur
Detective controls
Controls that discover problems as soon as they arise
Corrective controls
Controls that remedy control problems that have been discovered
Control objectives
statements of the desired result or purpose to be achieved by implementing control activities (procedures)
IS Control objectives
provide a complete set of high-level requirements to be considered by management for effective control of each IT process
COBIT 5
a comprehensive framework that assists enterprises in achieving their objectives for the governance and management of enterprise IT; helps enterprises create optimal value from IT by maintaining a balance between realizing benefits and optimizing risk levels and resource use
COBIT 5 Principles
- Meeting stakeholder needs
Controls
include policies, procedures and practices established by management to provide reasonable assurance that specific objectives will be achieved
Compliance Audit
an audit that includes specific tests of controls to demonstrate adherence to specific regulator or industry standards
Financial Audit
an audit that assesses the accuracy of financial reporting
Operational Audit
an audit designed to evaluate the internal control structure in a given process or area
Integrated Audit
an audit that combines financial and operational audit steps
Administrative Audit
an audit oriented to assess issues related to the efficiency of operational productivity within an organization
IS Audit
an audit that collects and evaluates evidence to determine whether the information systems and related resources adequately safeguard assets, maintain data and system integrity and availability, provide relevant and reliable information, achieve organizational goals, consume resources efficiently, and have, in effect, internal controls that provide reasonable assurance that business, operational and control objectives will be met
Statement on Standards for Attestation Engagements (SSAE 16)
a widely known auditing standard developed by the AICPA that defines the professional standards used by a service auditor to assess the internal controls of a service organization
Forensic Audit
an audit specialized in discovering, disclosing and following up on frauds and crimes
Audit Program
identifies the scope, audit objectives and audit procedures to obtain sufficient, relevant and reliable evidence to draw and support audit conclusions and opinions; includes the audit strategy and audit plan
Audit Strategy
overall approach to the audit that considers the nature of the client, risk of significant misstatements, and other factors such as the number of client locations and past effectiveness of client controls
Audit Methodology
a set of documented audit procedures designed to achieve planned audit objectives; components include a statement of scope, statement of objectives, and a statement of audit programs
Risk-Based Auditing
an audit approach that is adapted to develop and improve the continuous audit process; used to assess risk and assist the IS auditor in making the decision to perform either compliance testing or substantive testing
Inherent Risk
the risk level or exposure of the process/entity to be audited without taking into account the controls that management has implemented
Control Risk
the risk that a material error exists that would not be prevented or detected on a timely basis by the system of internal controls
Detection Risk
the risk that material errors or misstatements that have occurred will not be detected by the IS auditor
Overall Audit Risk
the probability that information or financial reports may contain material errors and that the auditor may not detect an error that has occurred
Statistical Sampling Risk
the risk that incorrect assumptions are made about the characteristics of a population from which a sample is selected
Risk Mitigation
a risk response that includes applying appropriate controls to reduce the risks
Risk Acceptance
a risk response that includes knowingly and objectively not taking action, providing the risk clearly satisfies the organization’s policy and criteria
Risk Avoidance
a risk response that includes avoiding risks by not allowing actions that would cause the risks to occur
Risk transfer/sharing
a risk response that includes transferring the associated risks to other parties, e.g. insurers or suppliers
Audit objectives
refer to the specific goals that must be accomplished by the audit
Compliance Testing
evidence gathering for the purposes of testing an organization’s compliance with control procedures; determines if controls are being applied in a manner that complies with management policies and procedures
Substantive Testing
evidence gathering for the purposes of evaluating the integrity of individual transactions, data or other information; substantiates the integrity of actual processing
Evidence
any information used by the IS auditor to determine whether the entity or data being audited follows the established criteria or objectives, and supports audit conclusions
Sample
the subset of population members used to perform testing
Statistical Sampling
sampling that uses the laws of probability to select and evaluate the results of an audit sample, thereby permitting the auditor to quantify the sampling risk for the purpose of reaching a conclusion about the population
Nonstatistical Sampling
audit sampling that relies on the auditor’s judgment to determine sample size, select the sample, and/or evaluate the results for the purpose of reaching a conclusion about the population
Attribute Sampling
sampling used to estimate the proportion of a population that possesses a specified characteristic; the primary sampling method used for compliance testing
Stop-or-go Sampling
sampling that allows the audit test to be stopped at the earliest possible moment
Discovery Sampling
a sampling plan that is appropriate when the expected occurrence rate is extremely low, used when the auditor desires a specific chance of observing at least one example of occurrence
Variable Sampling
sampling that deals with population characteristics that vary, such as monetary values and weights, and provides conclusions related to deviations from the norm
Confidence Coefficient
a percentage expression of the probability that the characteristics of the sample are a true representation of the population
Level of Risk
equal to one minus the confidence coefficient
Precision
represents the acceptable range difference between the sample and the actual population
Expected Error Rate
an estimate stated as a percent of the errors that may exist
Sample mean
the sum of all sample values, divided by the size of the sample
Sample standard deviation
computes the variance of the sample values from the mean of the sample
Tolerable error rate
maximum misstatement or number of errors that can exist without an account being materially misstated
Population standard deviation
measures the relationship to the normal distribution
Computer-Assisted Audit Techniques (CAAT)
refer to audit software that uses auditor-supplied specifications to generate a program that performs audit functions, thereby automating or simplifying the audit process
Generalized Audit Software (GAS)
standard software designed to read, process, and write data with the help of functions performing specific audit routines and with self-made macros
Utility Software
subset of software that provides evidence to auditors about system control effectiveness
Test Data
using a sample set of data to assess whether logic errors exist in a program and whether the program meets its objectives
Compensating Control
A control that reduces the risk that an existing or potential control weakness will result in a failure to meet a control objective (e.g., avoiding misstatements).
Audit Report
used by the auditor to report findings and recommendations to management
Control Self-Assessment (CSA)
A method/process by which management and staff of all levels collectively identify and evaluate risk and controls with their business areas. This may be under the guidance of a facilitator such as an auditor or risk manager; includes testing the design of automated application controls
Traditional Auditing Approach
any approach in which the primary responsibility for analyzing and reporting on internal control and risk is assigned to auditors, and to a lesser extent, controller departments and outside consultants
Integrated Auditing
the process whereby appropriate audit disciplines are combined to assess key internal controls over an operation, process or entity
Continuous Monitoring
provided by IS management and tools and typically based on automated procedures to meet fiduciary responsibilities
Continuous Auditing
“A methodology that enables independent auditors to provide written assurance on a subject matter using a series of auditors reports issued simultaneously with or a short period of time after the occurrence of the events underlying the subject matter”
Corporate Governance
the system by which business corporations are directed and controlled; a set of responsibilities and practices used by an organization’s management to provide strategic direction, thereby ensuring that goals are achievable, risks are properly addressed and organizational resources are properly utilized
Governance of Enterprise IT (GEIT)
the body of issues addressed in considering how IT is applied within the enterprise
IT Governance
a structure of relationships and processes used to direct and control the enterprise toward achievement of its goals by adding value while balancing risk vs. return over IT and its processes
IT Governance Focus Areas
- Strategic Alignment
Strategic Alignment
focuses on ensuring the linkage of business and IT plans; defining, maintaining and validating the IT value proposition; and aligning IT operations with enterprise operations
Value Delivery
executing the value proposition throughout the delivery cycle, ensuring that IT delivers the promised benefits against the strategy, concentrating on optimizing costs and proving the intrinsic value of IT
Resource Management
the optimal investment it, and the proper management of, critical IT resources: applications, information, infrastructure and people
Performance Management
tracks and monitors strategy implementation, project completion, resource usage, process performance and service delivery
IT Balanced Scorecard (BSC)
a process management evaluation technique that can be applied to the IT governance process in assessing the IT functions and processes; supplements traditional financial evaluation with measures concerning user satisfaction, internal processes and the ability to innovate
IT Strategy Committee
As a committee of the board, it assists the board in overseeing the enterprise’s IT-related matters by ensuring that the board has the internal and external information it requires for effective IT governance decision making.
IT Steering Committee
a committee, comprised of a group of managers and staff representing various organizational units, set up to establish IT priorities and to ensure that the MIS function is meeting the needs of the enterprise
Information Security Governance
governance focused on specific value drivers: confidentiality, integrity, and availability of information, continuity of services and protection of information assets
Process Integration
integration of an organization’s management assurance processes for security
Enterprise Architecture (EA)
involves documenting an organization’s IT assets in a structured manner to facilitate understanding, management and planning for IT investments; involves both a current state and an optimized state
Zachman Framework for Enterprise Architecture
a model framework that is a starting point for many contemporary EA projects the helps move IT projects from abstract to physical using models and representations with progressively greater levels of detail
Federal Enterprise Architecture (FEA)
a business and performance based framework to support cross-agency collaboration, transformation and government-wide improvement
Strategic Planning
long-term direction an enterprise wants to take in leveraging information technology for improving its business processes
IT Portfolio Management
has an explicitly directive, strategic goal in determining what the enterprise will continue to invest in vs. what the enterprise will divest
Policy
high-level document that represents the corporate philosophy of an organization
Security Policy
policy that communicates a coherent security standard to users, management and technical staff
High-level Information Security Policy
policy that includes statements on confidentiality, integrity, and availability
Data Classification Policy
policy that should describe the classifications, levels of control at each classification and responsibilities of all potential users including ownership
Acceptable Use Policy
policy that includes information for all information resources and describes the organizational permissions for the usage of IT and information-related resources
End-user Computing Policy
policy that describes the parameters and usage of desktop, mobile computing and other tools by users
Access Control Policy
policy that describes the method for defining and granting access to users to various IT resources
Procedures
detailed steps defined and documented for implementing policies
Risk Management
the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives and deciding what countermeasures, if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization
Key performance indicators
The quantifiable metrics a company uses to evaluate progress toward critical success factors
Threat
any circumstance or event with the potential to cause harm (such as destruction, disclosure, modification of data and/or denial of service) to an information resource
Vulterabilities
characteristics of information resources that can be exploited by a threat to cause harm
Impact
the result of a threat agent exploiting a vulnerability
Residual Risk
the remaining level of risk once controls have been applied; can be used by management to further reduce risk by identifying those areas in which more control is needed
Qualitative Analysis
method that uses words or descriptive rankings to describe in the impact or likelihood of risk (high, medium, low)
Semi-quantitative Analysis
method that uses descriptive rankings that are associated with a numeric scale to describe the impact or likelihood of risk
Quantitative Analysis
method that uses numeric values to describe the likelihood and impact of risk, using data from several types of sources such as historic records, past experiences, industry practices and records, statistical theories, testing, and experiments (usually monetary terms)
IS Management
practices that reflect the implementation of policies and procedures developed for various IS-related management activities
Human Resource Management
organizational policies and procedures for recruiting, selecting, training and promoting staff, measuring staff performance, disciplining staff, succession planning, and staff retention
Sourcing
the way in which the organization will obtain the IS functions required to support the business (in-house, outsource)
Outsourcing
contractual agreements under which an organization hands over control of part or all of the functions of the IS department to an external party
Service Level Agreement (SLA)
a document that provides a company with a performance guarantee for services outsourced to a vendor
Benchmarking
A process of continuously measuring system results, comparing those results to optimal system performance (industry standards or best practices), and identifying steps and procedures to improve system performance
Cloud Computing
model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction
Statement on Standards for Attestation Engagements (SSAE 16)
provides a framework for three Service Organization Control (SOC) reporting options
SOC 1 Report
focus solely on controls at a service organization that are likely to be relevant to an audit of a user entity’s financial statements
Governance of Outsourcing
the set of responsibilities, roles, objectives, interfaces and controls required to anticipate change and manage the introduction, maintenance, performance, costs and control of third-party provided services
Change Management
involves the use of a defined and documented process to identify and apply technology improvements at the infrastructure and application level that are beneficial to the organization and involve all levels of the organization impacted by the changes
Quality Management
one of the means by which IT department-based processes are controlled, measured and improved; may include: software development/maintenance/implementation, acquisition of hardware or software, day-to-day operations, service management, security, HR management, general administration
Ways to use performance measures
- Measure products/services
Systems development manager
responsible for programmers and analysts who implement new systems and maintain existing systems
Project manager
responsible for planning and executing IT projects and may report to a project management officer or to the development organization
Service desk (help desk)
unit within an organization that responds to technical questions and problems faced by users
End user
responsible for operations related to business application services; used to distinguish the person for whom the product was designed from the person who programs, services, or installs applications
End-user support manager
responsible as a liaison between the IS department and the end users
Data manager
responsible for the data architecture in larger IT environments and tasked with managing data as a corporate asset
Quality Assurance (QA) manager
responsible for negotiating and facilitating quality activities in all areas of information technology
Operations manager
responsible for computer operations personnel, including all staff required to run the data center efficiently and effectively
Control group
responsible for the collection, conversion and control of input, and the balancing and distribution of output to the user communicty
Media manager
responsible for recording, issuing, receiving, and safeguarding all program and data files that are maintained on removable media
Data Entry
The process of getting information into a database, usually done by people typing it in by way of data-entry forms designed to simplify the proces
Systems administrator
responsible for maintaining major multi-user computer systems, including LANs, WLANs, WANs, PANs, SANs, intranets and extranets, and mid-range and mainframe systems
Security Administrator
responsible for ensuring that the various users are complying with the corporate security policy and controls are adequate to prevent unauthorized access to the company assets
Quality Assurance (QA)
helps the IS department to ensure that personnel are following prescribed quality processes
Quality Control (QC)
responsible for conducting tests or reviews to verify and ensure that software is free from defects and meets user expectations
Database Administrator (DBA)
custodian of an organization’s data; defines and maintains the data structures in the corporate database system
Systems analyst
specialist who designs systems based on the needs of the user and are usually involved during the initial phase of the system development life cycle
Security architect
responsible for evaluating security technologies; design security aspects of the network topology, access control identity management and other security systems; and establish security policies and security requirements
Applications staff
responsible for developing and maintaining applications; should work in a test-only environment
Infrastructure staff
responsible for maintaining the systems software, including the operating system
Network administrator
responsible for key components of the infrastructure (routers, switches, firewalls, network segmentation, performance management, remote access, etc.); report to the director of the IPF or an end-user manager
Segregation of Diteis
avoids the possibility that a single person could be responsible for diverse and critical functions in such a way that errors or misappropriations could occur and not be detected in a timely manner an in the normal course of business processes
Duties that should be segregated
custody of the assets, authorization, recording transactions
Compensating controls
internal controls that are intended to reduce the risk of an existing or potential control weakness when duties cannot be appropriately segregated
Audit trails
help the IS and user departments as well as the IS auditor by providing a map to retrace the flow of a transaction; recreates the actual transaction flow from the point of origination to its existence on an updated file
Reconciliation
independent verification typically performed by the user that increases the level of confidence that the application processed successfully and the data are in proper balance
Exception reporting
Identifying data that is not within “normal limits” so that managers can follow up and take corrective action; should require evidence, such as initials on a report, noting that the exception has been handled properly
Transaction logs
a record of transactions (can be logged manually or automatically)
Request for proposal
A document specifying all the system requirements and soliciting a proposal from each vendor contacted
Business continuity
the ability of an organization to maintain its operations and services in the face of a disruptive event
Business continuity plan
Provides procedures for emergency responses, extended backup operations, and post-disaster recovery
Disaster recovery plan
a detailed process for recovering information or an IT system in the event of a catastrophic disaster such as a fire or flood
Restoration plan
a process to return operations to normality whether in a restored or new facility
IS business continuity planning
specifies how to resume business processes specifically related to IS in the face of a disruptive event; should be aligned with the strategy of the organization
Risk analysis calculation
how risk is calculated; uses either qualitative or quantitative means
Business Impact Analysis (BIA)
the activity in Business Continuity Management that identifies vital business functions and their dependencies; allows the organization to determine the maximum downtime possible and to quantify losses as they grow after a disruption, thus allowing the organization to make a decision on the technology used for protection and recovery of its key information assets
IT disaster recovery plan
typically details the process IT personnel will use to restore the computer systems
Disasters
disruptions that cause critical information resources to be inoperative for a period of time, adversely impacting organizational operations
Pandemic
an epidemic or outbreak of infectious diseases in humans that have the ability to spread rapidly over large areas
Business continuity policy
a document approved by top management that defines the extent and scope of the business continuity effort within the organization
Incident
any unexpected event, even if it causes no significant damage
Negligible incident
incident that causes no perceptible or significant damage
Minor incidents
incidents that, while not negligible, produce no negative material (of relative importance) or financial impact
Major incidents
incidents that cause a negative material impact on business processes and may affect other systems, departments or even outside clients
Crisis
a major incident that can have serious material impact on the continued functioning of the business and may also adversely impact other systems or third parties
Downtime cost
costs incurred during the period after a disaster in which the business is not functioning; cost grows quickly with time, where the impact of a disruption increases the longer it lasts
Recovery cost
cost of activating the business continuity plan (alternative corrective measures), which decreases with the target chosen for recovery time
Risk ranking
determination of risk based upon the impact derived from the critical recovery time period, as well as the likelihood that an adverse disruption will occur (critical, vital, sensitive, nonsensitive)
Desk-based evaluation/paper test
a paper walk-through of the BCP, involving major players in the plan’s execution who reason out what might happen in a particular type of service disruption
Preparedness test
localized version of a full BCP test, wherein actual resources are expanded in the simulation of a system crash
Full operational test
one step away from an actual service disruption; a full test of the BCP
Benefits realization
the process by which an organization evaluates technology solutions to business problems
Project portfolio
all of the projects (related or unrelated) being carried out in an organization at a given point in time
Program
a group of projects and time-bound tasks that are closely linked together through common objectives, a common budget, and intertwined schedules and strategies
Business case
document that provides the information required for an organization to decide whether a project should proceed
Project management
the application of knowledge, skills, tools, and techniques to a broad range of project activities to achieve a stated objective such as meeting the defined user requirements, budget and deadlines for an IS project
Influence project organization
a type of project organization in which the project manager has only a staff function without formal management authority; the PM can only advise peers and team members as to which activities should be completed
Pure project organization
a type of project organization in which the project manager has formal authority over those taking part in the project
Matrix project organization
a type of project organization in which management authority is shared between the project manager and the department heads
Specific, Measurable, Attainable, Realistic and Timely
SMART
Main objectives
objectives that will always be directly coupled with business success
Additional objectives
objectives that are not directly related to the main results of the project but may contribute to project success
Nonobjectives
objectives that add clarity to the scope, and project boundaries become clearer; these objectives shape the contours of the deliverables and help all parties to gain a clear understanding of what has to be done to avoid any ambiguities
Object breakdown structure (OBS)
a structure that represents the individual components of the solution and their relationships to each other in a hierarchical manner, either graphically or in a table
Work breakdown structure (WBS)
designed after the OBS has been compiled, this structures all the tasks that are necessary to build up the elements of the OBS during the project
Task list
a list of actions to be carried out in relation to work packages and includes assigned responsibilities and deadlines
Senior Management
management that demonstrates commitment to the project and approves the necessary resources to complete the project
User Management
management that assumes ownership of the project and resulting system, allocates qualified representatives to the team, and actively participates in business process redesign, system requirements definition, test case development, acceptance testing and user training
Project Steering Committee
group that provides overall direction and ensures appropriate representation of the major stakeholders in the project’s outcome; should be comprised of a senior representative from each relevant business area
Project Sponsor
person or group that provides funding for the project and works closely with the project manager to define the critical success factors and metrics for measuring the success of the project
Systems Development Management
management that provides technical support for hardware and software environments by developing, installing and operating the requested system
Project Manager
person that provides day-to-day management and leadership of the project, ensures that project activities remain in line with the overall direction, ensures appropriate representation of the affected departments, ensures that the project adheres to local standards, ensures that deliverables meet the quality expectations of key stakeholders, resolves interdepartmental conflicts, and monitors and controls costs and the project timetable
Systems Development Project Team
group that completes assigned tasks, communicates effectively with users by actively involving them in the development process, works according to local standards and advises the project manager of necessary project plan deviations
User Project Team
group that completes assigned tasks, communicates effectively with the systems developers by actively involving themselves in the development process as subject matter experts (SMEs), works according to local standards and advises the project manager of expected and actual project plan deviations
Security Officer
person that ensures that system controls and supporting processes provide an effective level of protection, based on the data classification set in accordance with corporate security policies and procedures
