As organizations become more dependent on cloud platforms, enterprise applications, data analytics, cybersecurity controls, artificial intelligence, and increasingly complex IT infrastructures, auditing information systems is no longer a narrow accounting function. Modern organizations need professionals who can determine whether technology is properly governed, adequately protected, resilient, compliant, and aligned with business objectives.
This is exactly where the Certified Information Systems Auditor (CISA) certification has built its reputation.
Offered by ISACA, CISA is one of the best-known professional certifications for people working in IT audit, information systems control, technology risk, governance, compliance, and security assurance. Unlike certifications that concentrate mainly on configuring technical products, the CISA certification focuses heavily on how technology should be evaluated from the perspective of risk, controls, governance, and business objectives.
For students and early-career IT professionals, this distinction is particularly important. You do not necessarily need to become the person configuring every firewall, database, server, or cloud platform. A CISA professional needs to understand these technologies well enough to evaluate whether the organization is using and controlling them appropriately.
This guide explains the CISA certification exam, its five domains, important IT auditing concepts, career value, eligibility requirements, exam strategy, and a practical study approach for candidates preparing for ISACA CISA.
What Is the CISA Certification?
CISA stands for Certified Information Systems Auditor. It is a professional certification administered by ISACA and is designed primarily for professionals involved in auditing, monitoring, assessing, and controlling information systems and technology environments.
The certification is particularly relevant to professionals working in areas such as:
- IT auditing
- Information systems auditing
- Technology risk management
- IT governance
- Internal audit
- Cybersecurity assurance
- Governance, risk, and compliance (GRC)
- Information security
- Regulatory compliance
- IT controls and assurance
- Business continuity and disaster recovery
The certification is not tied to one operating system, security appliance, cloud provider, or programming language. Instead, CISA examines whether candidates understand how organizations should manage and control technology throughout its lifecycle.
That makes the certification applicable across financial services, consulting, government, telecommunications, healthcare, manufacturing, technology companies, cloud environments, and many other industries.
If you are preparing for the exam and want a focused overview of the certification objectives, you can also review this CISA certification preparation resource.
CISA Exam at a Glance
The official certification and exam designation is CISA. Candidates sometimes search for terms such as “CISA exam code,” but unlike many vendor certifications that use numerical exam codes, ISACA generally identifies the examination by the certification name itself.
| Item | CISA Exam Information |
|---|---|
| Certification | Certified Information Systems Auditor (CISA) |
| Provider | ISACA |
| Exam Designation | CISA |
| Number of Questions | 150 |
| Exam Duration | 4 hours |
| Exam Domains | 5 |
| Passing Score | 450 on ISACA’s 200–800 scaled scoring system |
| Exam Delivery | Computer-based testing through authorized testing centers or remote proctoring, subject to availability |
| Member Exam Fee | US$575 at the time of writing |
| Non-Member Exam Fee | US$760 at the time of writing |
Because exam fees, policies, and scheduling rules can change, candidates should always verify the latest information with ISACA before registering.
What Does the CISA Exam Test?
The CISA examination covers five job-practice domains. The current structure places particularly strong emphasis on information systems operations, business resilience, and protection of information assets.
| Domain | Topic | Exam Weight |
|---|---|---|
| Domain 1 | Information Systems Auditing Process | 18% |
| Domain 2 | Governance & Management of IT | 18% |
| Domain 3 | Information Systems Acquisition, Development & Implementation | 12% |
| Domain 4 | Information Systems Operations & Business Resilience | 26% |
| Domain 5 | Protection of Information Assets | 26% |
Understanding these percentages is useful when creating a study plan. Domains 4 and 5 together represent more than half of the exam, but candidates should not ignore Domains 1 and 2. Many of the reasoning principles used throughout CISA questions originate from audit methodology, governance, risk management, and control concepts covered in these earlier domains.
A good CISA exam preparation strategy should therefore balance domain weighting with a strong understanding of audit principles rather than focusing only on cybersecurity topics.
Domain 1: Information Systems Auditing Process – 18%
The first domain establishes the foundation of the CISA mindset: how a professional auditor plans, performs, documents, and communicates an information systems audit.
Important topics include:
- IS audit standards and guidelines
- Professional ethics
- Different types of audits and assessments
- Risk-based audit planning
- Audit objectives and audit scope
- Control types
- Audit project management
- Audit testing
- Sampling methodologies
- Evidence collection
- Audit data analytics
- Reporting audit findings
- Communicating recommendations
- Audit quality assurance
The Risk-Based Audit Approach
One of the most important CISA concepts is risk-based auditing.
An auditor does not simply inspect every technical component with equal intensity. Instead, the auditor identifies business objectives, important assets, threats, vulnerabilities, existing controls, and potential impacts. Audit resources can then be focused on areas representing the greatest risk to the organization.
A simplified thought process might look like this:
Business Objective → Risk → Control → Audit Evidence → Conclusion
This logic appears repeatedly throughout CISA-style questions.
Audit Evidence
Candidates should also understand the qualities of appropriate audit evidence. Evidence should generally be sufficient, reliable, relevant, and useful to support an audit conclusion.
For example, an auditor reviewing access controls should normally rely on stronger evidence than simply asking a system administrator whether access reviews occur. Configuration records, access logs, review documentation, approval records, and independent observations may provide considerably stronger evidence.
Domain 2: Governance & Management of IT – 18%
Technology should not operate independently from the business. Domain 2 examines whether IT governance, management practices, resources, policies, and risk processes support organizational objectives.
Major areas include:
- IT governance frameworks
- Organizational structures
- IT strategy
- Policies, standards, procedures, and practices
- Enterprise architecture
- Enterprise risk management
- Privacy programs
- Data governance
- Data classification
- IT resource management
- Vendor and third-party management
- IT performance measurement
- Quality assurance
Governance vs. Management
This distinction causes confusion for many new candidates.
Governance focuses on direction, oversight, accountability, stakeholder needs, and whether technology supports organizational objectives.
Management focuses more on planning, building, operating, monitoring, and executing activities needed to achieve that direction.
CISA questions often test whether a responsibility belongs to senior governance bodies or operational management.
Policies, Standards, Procedures, and Guidelines
Candidates should understand the hierarchy and purpose of governance documents.
- Policies define management expectations and high-level requirements.
- Standards establish mandatory specifications or requirements.
- Procedures describe how activities should be performed.
- Guidelines normally provide recommended practices or guidance.
Knowing these differences helps both on the exam and in real-world audit engagements.
Domain 3: Information Systems Acquisition, Development & Implementation – 12%
Information systems create risk long before they enter production. Domain 3 evaluates how systems are selected, designed, developed, tested, implemented, migrated, and reviewed.
Key subjects include:
- Project governance
- Project management
- Business cases
- Feasibility analysis
- System development methodologies
- System Development Life Cycle (SDLC)
- Agile development
- Control design
- Testing strategies
- Configuration management
- Release management
- System migration
- Infrastructure deployment
- Data conversion
- Post-implementation reviews
Why CISA Candidates Need Project Management Knowledge
This domain is particularly relevant to candidates with a project management background.
An information systems auditor may review whether:
- The project has appropriate governance.
- Business requirements have been formally approved.
- Security requirements were included early enough.
- Developers and production administrators have appropriately separated responsibilities.
- Testing is independent and adequate.
- Changes are authorized.
- Production migration is controlled.
- Data conversion is complete and accurate.
- The completed system meets business objectives.
A common principle is that controls should be designed into systems as early as practical rather than added after implementation.
Domain 4: Information Systems Operations & Business Resilience – 26%
Domain 4 is one of the largest areas of the CISA exam. It focuses on whether technology operations reliably support the organization and whether critical business services can survive or recover from disruption.
Topics include:
- IT infrastructure components
- IT asset management
- Production processing
- Job scheduling and automation
- System interfaces
- Shadow IT
- End-user computing
- Capacity management
- Availability management
- Incident management
- Problem management
- Change management
- Configuration management
- Patch management
- Log management
- Service level management
- Database management
- Backup and restoration
- Business continuity
- Disaster recovery
Incident Management vs. Problem Management
This is a useful distinction to remember.
Incident management focuses on restoring normal service as quickly as practical after a disruption.
Problem management focuses on identifying and addressing underlying causes so that incidents do not continue to recur.
An incident may therefore be resolved before the underlying problem has been permanently eliminated.
Business Impact Analysis
The Business Impact Analysis (BIA) is a central business resilience concept.
A BIA helps an organization determine which business processes are critical, what dependencies they have, how disruption would affect the organization, and how quickly operations need to be recovered.
CISA candidates should understand concepts such as:
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO)
- Critical business processes
- System dependencies
- Recovery priorities
- Backup strategies
- Disaster recovery testing
One important exam principle is that technology recovery requirements should generally be driven by business requirements, not merely by what is technically convenient.
Domain 5: Protection of Information Assets – 26%
Domain 5 is the second 26% domain and covers the security and control mechanisms used to protect organizational information assets.
This domain includes:
- Information security frameworks
- Physical and environmental controls
- Identity and access management
- Network security
- Endpoint security
- Data loss prevention
- Encryption
- Public Key Infrastructure (PKI)
- Cloud environments
- Virtualization
- Mobile technologies
- Wireless technologies
- Internet of Things (IoT)
- Security awareness
- Cyberattack techniques
- Security testing
- Security monitoring
- Incident response
- Digital evidence and forensic principles
Confidentiality, Integrity, and Availability
The familiar CIA triad remains fundamental:
- Confidentiality – information is accessible only to authorized parties.
- Integrity – information remains accurate, complete, and protected from unauthorized modification.
- Availability – authorized users can access systems and information when required.
CISA questions frequently require candidates to determine which control best addresses one of these security objectives.
Identity and Access Management
Important IAM principles include:
- Least privilege
- Need-to-know access
- Role-based access
- Privileged access management
- Authentication
- Authorization
- Periodic access reviews
- Account provisioning and deprovisioning
- Segregation of duties
From an auditor’s perspective, it is not enough for an access control technology simply to exist. The auditor must consider whether access is properly approved, appropriate for job responsibilities, periodically reviewed, logged, and promptly removed when no longer required.
Preventive, Detective, and Corrective Controls
Understanding control classifications is essential for the CISA exam.
Preventive Controls
Preventive controls attempt to stop an undesirable event before it occurs.
Examples include:
- Multi-factor authentication
- Firewalls
- Segregation of duties
- Access restrictions
- Input validation
Detective Controls
Detective controls identify events that have already occurred or are occurring.
Examples include:
- Log monitoring
- Security alerts
- Audit trails
- Reconciliation
- Intrusion detection
Corrective Controls
Corrective controls reduce the impact of an event and help restore normal operations.
Examples may include:
- Restoring data from backups
- Incident remediation procedures
- Disaster recovery processes
- Applying corrective configuration changes
Many exam questions describe a control and ask candidates to identify its primary purpose. Understanding why a control exists is often more valuable than memorizing its name.
What Makes the CISA Exam Difficult?
The CISA examination is challenging, but not simply because it contains a large amount of technical material.
The greater challenge is learning to answer questions from an IS auditor’s perspective.
A network engineer may instinctively want to correct a misconfiguration. A security administrator may want to block a threat immediately. A project manager may want to resolve a schedule problem. An auditor, however, has a different role.
The auditor generally needs to:
- Understand the business objective.
- Identify the relevant risk.
- Evaluate existing controls.
- Obtain sufficient evidence.
- Determine the significance of findings.
- Communicate conclusions and recommendations.
Remembering your role is critical when two answer choices both appear technically reasonable.
How to Approach CISA Questions
CISA questions frequently use words such as:
- MOST important
- BEST
- FIRST
- GREATEST concern
- MOST likely
These words matter.
A question may contain several actions that would be reasonable in the real world, but the examination is asking candidates to identify the action that has the highest priority from the auditor’s perspective.
When answering scenario questions, ask yourself:
- What is the actual risk?
- What business objective is affected?
- What evidence is available?
- Is the auditor evaluating or implementing?
- Does the proposed answer address the root cause?
- Is there a more fundamental governance or control issue?
Regular practice with CISA exam questions and preparation materials can help candidates become more comfortable with these scenario-based decision patterns.
CISA Certification Experience Requirements
Passing the examination and becoming fully CISA certified are related but separate milestones.
Candidates can take the CISA exam before completing all of the professional experience required for certification.
To obtain the full CISA designation, ISACA generally requires a minimum of five years of professional information systems auditing, control, assurance, or security-related work experience. The required experience must satisfy ISACA’s certification rules, and certain experience waivers may be available depending on a candidate’s education and background.
Candidates who pass the examination must apply for certification within the period specified by ISACA. At present, ISACA provides candidates five years from passing the exam to apply for CISA certification.
This means students and early-career professionals can begin learning CISA concepts before they have accumulated five years of experience. They should simply understand that passing the exam does not automatically mean the full professional CISA designation has been awarded.
Maintaining the CISA Certification
CISA is not a one-time qualification that can simply be forgotten after passing the examination.
Certified professionals must maintain their knowledge through Continuing Professional Education (CPE).
Current ISACA requirements include:
- A minimum of 20 CPE hours per year
- At least 120 CPE hours during a three-year reporting period
- Compliance with ISACA’s professional ethics requirements
- Compliance with applicable certification maintenance requirements
The purpose is straightforward: technology, audit techniques, cyber risks, regulations, cloud environments, and business practices continue to evolve after someone becomes certified.
Is the CISA Certification Worth It?
For the right career path, CISA can be extremely valuable.
The certification is particularly relevant when job responsibilities involve determining whether technology is secure, controlled, compliant, resilient, and aligned with business needs.
1. Strong Recognition in IT Audit
CISA has been associated with the information systems auditing profession for decades and is recognized by employers around the world.
For candidates applying for IT auditor or technology risk positions, seeing CISA on a job description is common because the certification directly addresses the responsibilities of these roles.
2. Useful Beyond Traditional Audit
The knowledge covered by CISA is useful in many adjacent professions.
Professionals working in cybersecurity, compliance, IT risk, cloud assurance, internal controls, governance, consulting, or technology management can all benefit from understanding how auditors evaluate systems and controls.
3. Bridges Business and Technology
One of CISA’s greatest strengths is that it sits between technology and business management.
A CISA professional should be able to understand technical risks while also explaining their business implications to management.
For example, the real audit issue is rarely simply:
“The server is running an outdated component.”
The more important questions are:
- What vulnerability does this create?
- Which business processes depend on the server?
- What is the likelihood and impact of exploitation?
- Are compensating controls available?
- Has management formally accepted the residual risk?
This risk-oriented thinking is useful well beyond the examination.
Who Should Consider the CISA Certification?
CISA may be a good choice for:
- IT auditors
- Internal auditors
- Technology risk analysts
- Information security professionals
- Cybersecurity auditors
- Compliance professionals
- GRC analysts
- IT governance professionals
- Cloud security and assurance professionals
- Information systems consultants
- IT managers
- Students interested in IT audit or technology risk careers
It can also complement project management knowledge because major technology projects need governance, risk assessment, quality controls, change management, security reviews, implementation testing, and post-implementation evaluation.
CISA vs. CISM: What Is the Difference?
CISA and CISM are both ISACA certifications, but they address different professional perspectives.
| CISA | CISM |
|---|---|
| Focuses on auditing and evaluating information systems | Focuses on managing information security programs |
| Strong focus on audit, assurance, and controls | Strong focus on information security management |
| Common for IT auditors and assurance professionals | Common for security managers and security leaders |
| Evaluates whether controls are effective | Helps design and manage security programs |
There is overlap in areas such as governance, risk, security, and incident management, but the professional viewpoint is different.
How Long Should You Study for the CISA Exam?
There is no universal study period because candidates begin with different levels of experience.
A professional who already performs IT audits may move quickly through Domain 1 but need additional time for network security or disaster recovery. A network engineer may find Domain 5 easier but require more study time for audit methodology and governance.
For many candidates, a structured preparation period of approximately 8 to 12 weeks can provide a practical starting point, assuming regular study throughout the week.
The more useful measurement, however, is not the number of weeks studied. It is whether you can consistently explain why the correct answer is better than the alternatives.
A Practical CISA Study Plan
Phase 1: Understand the Exam Structure
Before memorizing terminology, understand the five domains and their weightings.
This prevents the common mistake of spending excessive time on familiar subjects while neglecting heavily tested areas.
Phase 2: Build the Audit Foundation
Study Domain 1 carefully, even if it represents only 18% of the exam.
Make sure you understand:
- Risk-based auditing
- Audit planning
- Control objectives
- Evidence
- Sampling
- Reporting
- Professional independence
These concepts influence how you interpret questions from every other domain.
Phase 3: Learn Governance and Project Controls
Move into Domains 2 and 3 and connect IT processes with organizational objectives.
Instead of memorizing isolated definitions, ask why a particular governance structure, policy, control, or project process exists.
Phase 4: Spend Significant Time on Domains 4 and 5
Because these two domains represent 52% of the examination, candidates should devote substantial preparation time to:
- IT operations
- Change management
- Incident and problem management
- Business continuity
- Disaster recovery
- Identity management
- Network security
- Encryption
- Cloud security
- Security monitoring
- Incident response
Phase 5: Practice Scenario-Based Questions
Reading alone is rarely enough.
Practice questions teach you how ISACA-style scenarios are structured. More importantly, reviewing incorrect answers helps reveal whether you misunderstood a technical concept or simply approached the scenario from the wrong professional perspective.
If you are looking for additional practice during this stage, a structured CISA study guide and practice resource can be useful alongside official documentation and your own notes.
When reviewing a question, do not stop at:
“The correct answer is B.”
Instead ask:
- Why is B correct?
- Why is A weaker?
- Under what circumstances could C become correct?
- What principle is the question actually testing?
Common CISA Exam Preparation Mistakes
Mistake 1: Studying Only Cybersecurity
Security is important, but CISA is not simply a cybersecurity exam.
You also need a solid understanding of auditing, governance, project controls, IT operations, resilience, risk, and business processes.
Mistake 2: Answering as a System Administrator
If the question says you are an auditor, remain an auditor.
Auditors evaluate controls and provide assurance. They generally do not directly assume management responsibility for implementing controls.
Mistake 3: Memorizing Without Understanding Risk
Memorization can help with terminology, but scenario questions require judgment.
Try to understand the relationship among:
Asset → Threat → Vulnerability → Risk → Control → Residual Risk
Mistake 4: Ignoring Business Impact
CISA is ultimately about protecting and supporting organizational objectives.
The most technically advanced option is not automatically the best answer if it does not address the most significant business risk.
Mistake 5: Spending Too Long on One Question
With 150 questions in four hours, candidates have an average of approximately 96 seconds per question.
Some questions can be answered quickly, giving you additional time for difficult scenarios. If one question is consuming too much time, consider marking it for review and returning later.
Important CISA Concepts to Remember
Before sitting the exam, make sure you are comfortable with at least the following concepts:
- Risk-based audit planning
- Audit independence
- Audit evidence
- Audit sampling
- Preventive, detective, and corrective controls
- Governance vs. management
- Policies, standards, procedures, and guidelines
- Segregation of duties
- Least privilege
- SDLC controls
- Change and configuration management
- Incident and problem management
- Business Impact Analysis
- RTO and RPO
- Business continuity planning
- Disaster recovery planning
- Backup and restoration
- Identity and access management
- Encryption and PKI
- Network and endpoint security
- Cloud and virtualization risks
- Security monitoring
- Incident response
- Digital evidence
Career Opportunities After CISA
The Certified Information Systems Auditor certification can support several career paths rather than locking professionals into a single job title.
Typical roles may include:
- IT Auditor
- Senior IT Auditor
- Information Systems Auditor
- Internal Auditor
- IT Risk Analyst
- Technology Risk Consultant
- Cybersecurity Auditor
- GRC Analyst
- Compliance Manager
- IT Governance Specialist
- Security Assurance Consultant
- IT Controls Manager
- Risk and Assurance Manager
At more senior levels, experience combined with audit, risk, security, and governance expertise can also support movement toward audit management, risk leadership, consulting, and broader technology governance roles.
Is CISA Suitable for Beginners and Students?
Yes, but with an important qualification.
You do not need to have completed the full professional experience requirement before learning the material or sitting the examination. However, earning the full professional CISA certification requires qualifying experience under ISACA’s rules.
For students, studying CISA topics can provide an unusually broad view of enterprise technology. Instead of looking at IT only from the perspective of configuration or development, you begin asking questions such as:
- Who approved this system?
- What risk is being controlled?
- Who owns the data?
- How is access reviewed?
- What happens if the system fails?
- Can the organization restore its data?
- How are changes authorized?
- Is there sufficient audit evidence?
- Does management understand the residual risk?
That broader perspective can be useful whether you eventually work in audit, cybersecurity, cloud computing, project management, compliance, or IT management.
Frequently Asked Questions About the CISA Certification
What does CISA stand for?
CISA stands for Certified Information Systems Auditor, a professional certification administered by ISACA.
How many questions are on the CISA exam?
The CISA examination contains 150 questions.
How long is the CISA exam?
Candidates have up to four hours to complete the examination.
What score is required to pass CISA?
ISACA reports certification examination results using a scaled score from 200 to 800. A score of 450 or higher is required to pass.
How many CISA exam domains are there?
The current examination contains five domains covering auditing, IT governance, systems acquisition and implementation, IT operations and resilience, and information asset protection.
Can I take the CISA exam without five years of experience?
Yes. Candidates may take and pass the examination before completing the experience required for the full professional certification. The experience requirement must still be satisfied when applying for CISA certification.
Is CISA a cybersecurity certification?
CISA includes significant cybersecurity content, particularly in the Protection of Information Assets domain, but it is more accurately described as an IT audit, assurance, governance, risk, and control certification.
Is CISA difficult?
CISA can be challenging because candidates must combine technical knowledge with audit methodology, risk analysis, governance principles, and scenario-based judgment. Candidates who learn the IS auditor’s perspective generally perform better than those who rely only on memorization.
Is CISA worth getting?
For professionals pursuing IT audit, technology risk, GRC, security assurance, compliance, or governance careers, CISA remains one of the most relevant certifications available. Its value is strongest when combined with practical professional experience.
Where can I find additional CISA preparation resources?
Candidates can combine official ISACA materials, personal notes, hands-on audit experience, and additional CISA Certified Information Systems Auditor preparation resources to reinforce exam concepts and identify weak areas before test day.
Final Thoughts
The Certified Information Systems Auditor (CISA) certification is not designed to prove that you can configure every technology an organization uses. Its purpose is broader: demonstrating that you understand how to evaluate whether information systems are appropriately governed, controlled, secured, implemented, operated, and aligned with business objectives.
That is also why CISA preparation can initially feel different from traditional technical certification study.
You need to understand technology, but you must continuously view that technology through the lenses of risk, control, governance, evidence, and business impact.
For beginners, one of the best ways to prepare is to build a strong foundation in the auditing process first, then connect governance, project management, operations, business continuity, cybersecurity, and emerging technologies back to the same risk-based framework.
Do not simply memorize which option was correct in a practice question. Understand why it was correct from the auditor’s perspective. Once that way of thinking becomes natural, many CISA scenarios become much easier to interpret.
For students and professionals planning careers in IT audit, technology risk, cybersecurity assurance, governance, or compliance, preparing for the ISACA CISA certification exam can provide both a recognized professional objective and a valuable framework for understanding how modern organizations control technology risk.
Important: Exam fees, registration policies, certification requirements, testing arrangements, and exam content may be updated by ISACA. Candidates should verify the latest requirements with ISACA before registering for the CISA examination.
Official References and Further Reading
For candidates preparing for the ISACA Certified Information Systems Auditor (CISA) exam, the following official ISACA and authoritative industry resources provide additional guidance on information systems auditing, IT governance, risk management, information systems development, business resilience, cybersecurity, internal controls, and protection of information assets.
- ISACA CISA – Official Certification Page
– ISACA’s official Certified Information Systems Auditor certification page, providing information about exam registration, preparation resources, certification requirements, scheduling, and maintaining the CISA credential. - CISA Exam Content Outline
– The official ISACA examination blueprint covering the five major CISA domains: Information System Auditing Process, Governance and Management of IT, Information Systems Acquisition, Development and Implementation, Information Systems Operations and Business Resilience, and Protection of Information Assets. - ISACA Certification Exam Candidate Guide
– Official ISACA guidance covering exam registration, scheduling, preparation, testing rules, scoring, retake policies, remote proctoring, and other important information for CISA candidates. - How to Become CISA Certified
– ISACA’s official explanation of the CISA certification process, including exam requirements, professional work experience, certification applications, continuing professional education (CPE), and professional ethics. - CISA Official Review Manual
– ISACA’s official CISA review reference covering the knowledge, concepts, responsibilities, audit practices, governance principles, security controls, and information systems topics tested on the certification exam. - ISACA IT Audit Resources and IT Audit Framework (ITAF)
– ISACA’s authoritative IT audit resource center, including the IT Audit Framework (ITAF), audit programs, professional standards, guidance, tools, and resources for planning, performing, and reporting IT audit and assurance engagements. - ISACA COBIT Framework
– ISACA’s globally recognized framework for the governance and management of enterprise information and technology, providing useful background for IT governance, controls, risk management, performance, and alignment with business objectives. - NIST Cybersecurity Framework (CSF) 2.0
– An authoritative cybersecurity risk management framework covering Govern, Identify, Protect, Detect, Respond, and Recover activities and providing useful context for auditing cybersecurity controls and information asset protection. - The IIA Global Internal Audit Standards
– The Institute of Internal Auditors’ professional standards for internal auditing, providing valuable guidance on audit governance, independence, ethics, engagement planning, audit execution, communication, and quality assurance. - The IIA Global Guidance and Technology Audit Guides
– Additional authoritative internal audit guidance, including Global Technology Audit Guides (GTAGs) addressing information technology, cybersecurity risk, controls, governance, and technology assurance.
