A job practice serves as the basis for the exam and the requirements to earn the certification. This new job practice consists of task and knowledge statements representing the work performed in information systems audit, assurance and control. These statements and domains are the result of extensive research, feedback, and validation from subject matter experts and prominent industry leaders from around the globe.
The below job practice is organized by domains that will be tested for the first time on the June 2016 CISA exam. Starting in June 2016, the CISA exam will contain 150 questions testing the new job practice.
CISA Certification Job Practice Areas by DomainThe job practice domains and task and knowledge statements are as follows:
Domain 1—The Process of Auditing Information Systems (21%)
Domain 2—Governance and Management of IT (16%)
Domain 3—Information Systems Acquisition, Development and Implementation (18%)
Domain 4—Information Systems Operations, Maintenance and Service Management (20%)
Domain 5—Protection of Information Assets (25%)
Provide audit services in accordance with IS audit standards to assist the organization in protecting and controlling information systems. (21%)
Task Statements:Knowledge Statements:
1.1
Execute a risk-based IS audit strategy in compliance with IS audit standards to ensure that key risk areas are audited. 1.2
Plan specific audits to determine whether information systems are protected, controlled and provide value to the organization. 1.3
Conduct audits in accordance with IS audit standards to achieve planned audit objectives. 1.4
Communicate audit results and make recommendations to key stakeholders through meetings and audit reports to promote change when necessary. 1.5
Conduct audit follow-ups to determine whether appropriate actions have been taken by management in a timely manner.
Domain 2—Governance and Management of IT
1.1
Knowledge of ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques, Code of Professional Ethics and other applicable standards 1.2
Knowledge of the risk assessment concepts and tools and techniques used in planning, examination, reporting and follow-up 1.3
Knowledge of fundamental business processes (e.g., purchasing, payroll, accounts payable, accounts receivable) and the role of IS in these processes 1.4
Knowledge of the control principles related to controls in information systems 1.5
Knowledge of risk-based audit planning and audit project management techniques, including follow-up 1.6
Knowledge of the applicable laws and regulations that affect the scope, evidence collection and preservation, and frequency of audits 1.7
Knowledge of the evidence collection techniques (e.g., observation, inquiry, inspection, interview, data analysis, forensic investigation techniques, computer-assisted audit techniques [CAATs]) used to gather, protect and preserve audit evidence 1.8
Knowledge of different sampling methodologies and other substantive/data analytical procedures 1.9
Knowledge of reporting and communication techniques (e.g., facilitation, negotiation, conflict resolution, audit report structure, issue writing, management summary, result verification) 1.10
Knowledge of audit quality assurance (QA) systems and frameworks 1.11
Knowledge of various types of audits (e.g., internal, external, financial) and methods for assessing and placing reliance on the work of other auditors or control entities
Provide assurance that the necessary leadership and organizational structures and processes are in place to achieve objectives and to support the organization's strategy. (16%)
Task Statements:Knowledge Statements:
2.1
Evaluate the IT strategy, including IT direction, and the processes for the strategy’s development, approval, implementation and maintenance for alignment with the organization’s strategies and objectives. 2.2
Evaluate the effectiveness of the IT governance structure to determine whether IT decisions, directions and performance support the organization’s strategies and objectives. 2.3
Evaluate IT organizational structure and human resources (personnel) management to determine whether they support the organization’s strategies and objectives. 2.4
Evaluate the organization’s IT policies, standards and procedures, and the processes for their development, approval, release/publishing, implementation and maintenance to determine whether they support the IT strategy and comply with regulatory and legal requirements. 2.5
Evaluate IT resource management, including investment, prioritization, allocation and use, for alignment with the organization’s strategies and objectives. 2.6
Evaluate IT portfolio management, including investment, prioritization and allocation, for alignment with the organization’s strategies and objectives. 2.7
Evaluate risk management practices to determine whether the organization’s IT-related risk is identified, assessed, monitored, reported and managed. 2.8
Evaluate IT management and monitoring of controls (e.g., continuous monitoring, quality assurance [QA]) for compliance with the organization’s policies, standards and procedures. 2.9
Evaluate monitoring and reporting of IT key performance indicators (KPIs) to determine whether management receives sufficient and timely information. 2.10
Evaluate the organization’s business continuity plan (BCP), including alignment of the IT disaster recovery plan (DRP) with the BCP, to determine the organization’s ability to continue essential business operations during the period of an IT disruption.
Domain 3—Information Systems Acquisition, Development and Implementation
2.1
Knowledge of the purpose of IT strategy, policies, standards and procedures for an organization and the essential elements of each 2.2
Knowledge of IT governance, management, security and control frameworks, and related standards, guidelines and practices 2.3
Knowledge of the organizational structure, roles and responsibilities related to IT, including segregation of duties (SoD) 2.4
Knowledge of the relevant laws, regulations and industry standards affecting the organization 2.5
Knowledge of the organization’s technology direction and IT architecture and their implications for setting long-term strategic directions 2.6
Knowledge of the processes for the development, implementation and maintenance of IT strategy, policies, standards and procedures 2.7
Knowledge of the use of capability and maturity models 2.8
Knowledge of process optimization techniques 2.9
Knowledge of IT resource investment and allocation practices, including prioritization criteria (e.g., portfolio management, value management, personnel management) 2.10
Knowledge of IT supplier selection, contract management, relationship management and performance monitoring processes, including third-party outsourcing relationships 2.11
Knowledge of enterprise risk management (ERM) 2.12
Knowledge of the practices for monitoring and reporting of controls performance (e.g., continuous monitoring, quality assurance [QA]) 2.13
Knowledge of quality management and quality assurance (QA) systems 2.14
Knowledge of the practices for monitoring and reporting of IT performance (e.g., balanced scorecard [BSC], key performance indicators [KPIs]) 2.15
Knowledge of business impact analysis (BIA) 2.16
Knowledge of the standards and procedures for the development, maintenance and testing of the business continuity plan (BCP) 2.17
Knowledge of the procedures used to invoke and execute the business continuity plan (BCP) and return to normal operations
Provide assurance that the practices for the acquisition, development, testing and implementation of information systems meet the organization’s strategies and objectives. (18%)
Task Statements:
3.1
Evaluate the business case for the proposed investments in information systems acquisition, development, maintenance and subsequent retirement to determine whether the business case meets business objectives. 3.2
Evaluate IT supplier selection and contract management processes to ensure that the organization’s service levels and requisite controls are met. 3.3
Evaluate the project management framework and controls to determine whether business requirements are achieved in a cost-effective manner while managing risk to the organization. 3.4
Conduct reviews to determine whether a project is progressing in accordance with project plans, is adequately supported by documentation, and has timely and accurate status reporting. 3.5
Evaluate controls for information systems during the requirements, acquisition, development and testing phases for compliance with the organization's policies, standards, procedures and applicable external requirements. 3.6
Evaluate the readiness of information systems for implementation and migration into production to determine whether project deliverables, controls and the organization's requirements are met. 3.7
Conduct post-implementation reviews of systems to determine whether project deliverables, controls and the organization's requirements are met.