Topics in this domain
- Exam Technique: Thinking Like an IS Auditor
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Exam Technique: Thinking Like an IS Auditor
The exam in numbers
| Item | Detail |
|---|---|
| Questions | 150 multiple choice, one best answer from four |
| Time | 4 hours |
| Scoring | Scaled from 200 to 800; 450 passes |
| Weights | Domain 1 18%, Domain 2 18%, Domain 3 12%, Domain 4 26%, Domain 5 26% |
| To certify after passing | Five years of IS audit, control or security experience (some substitutions allowed), plus the code of ethics and continuing education |
Check ISACA’s candidate guide for current fees, booking and identification rules before you sit.
Two answers look right
Most CISA questions have two or three plausible options. They’re written so that a good engineer and a good auditor would choose differently. The exam is testing whether you think like an independent auditor.
Example. “An auditor finds that a critical patch hasn’t been applied. What should the auditor do FIRST?” Applying the patch is the engineer’s answer. The auditor first determines the risk: is the system exposed, and are there compensating controls? Then the auditor reports.
A method for every question
- Find the role: you’re the IS auditor, independent and evidence-based.
- Find the qualifier: FIRST, BEST, MOST, PRIMARY or GREATEST concern.
- Find the real problem: is the question about risk, a control, evidence, independence or reporting?
- Eliminate answers where the auditor implements, decides, approves or fixes.
- Choose the auditor’s answer: evaluate, verify, report, recommend.
The auditor’s mindset
| Usually right | Usually wrong |
|---|---|
| Understand the business and risk first | Fix the problem yourself |
| Gather and verify evidence | Design or approve controls you’ll later audit |
| Test the control rather than just asking | Accept management’s word without evidence |
| Report findings to the right level | Drop a finding because management disagrees |
| Recommend; management decides | Choose the most technical answer |
| Protect independence | Absolute words: always, never, all |
These are tendencies, not rules. Always read the scenario carefully.
Reading the qualifiers
| Qualifier | What it’s really asking |
|---|---|
| FIRST | The correct sequence of the audit process |
| BEST evidence | The most reliable and independent evidence |
| PRIMARY purpose | The fundamental reason, not a side benefit |
| GREATEST concern / risk | What creates the most exposure for the business |
| MOST effective control | Usually preventive and automated, if it addresses the risk |
Preparing well
- Learn the concepts, then practise questions and read every explanation, including for questions you got right.
- For each wrong answer, ask: why is the correct option more of an auditor’s answer?
- Study by weight: Domains 4 and 5 make up 52% of the exam.
- Pace yourself at about 1.5 minutes per question; flag hard ones and return.
- Answer every question; there’s no penalty for guessing.
In short
- The CISA exam has 150 multiple-choice questions in 4 hours; scores are scaled from 200 to 800 and 450 passes.
- Every question is answered from the IS auditor's viewpoint: independent, risk-based and driven by evidence.
- Read the qualifier carefully: FIRST, BEST, MOST, PRIMARY and GREATEST concern change which answer is right.
- The auditor evaluates, tests, reports and recommends; management designs, implements and decides.
- FIRST questions are usually about understanding the business and risk, or gathering evidence, before concluding.
- Eliminate answers where the auditor fixes things, approves controls, or accepts claims without evidence.
Exam traps
- Choosing an answer where the auditor implements a fix; that impairs independence.
- Accepting management's statement instead of verifying with evidence.
- Picking the most technical answer instead of the audit-process answer.
- Dropping or softening a finding because management disagrees.
- Choosing answers with 'always', 'never' or 'all'.
Slides
Click the slide and use the arrow keys. F toggles full screen.
A method for every question
The auditor's mindset
1 / 9