Duration 5 days – 35 hrs
Overview.
The CISA Training Course is designed for professionals responsible for auditing, controlling, and assuring information security systems within an organization. This course aligns with ISACA’s CISA curriculum and prepares participants for the CISA certification exam. Through comprehensive instruction and hands-on exercises, participants will learn how to conduct information system audits, assess IT governance and management practices, and oversee information system acquisition, development, and implementation to ensure that security controls align with business objectives.
Objectives
- Gain a thorough understanding of the information systems auditing process and control frameworks.
- Learn to evaluate IT governance and management practices to support business goals.
- Develop skills to audit and assure information system acquisition, development, and implementation processes.
- Understand how to apply industry best practices for IT audit, security, and risk management.
- Prepare for the CISA certification exam with a focus on practical auditing and control skills.
Audience
- IT Auditors
- Information Security Managers
- Compliance and Risk Professionals
- IT Managers and Directors
- IT Governance and Assurance Professionals
- Systems Analysts
- Professionals preparing for the CISA certification exam
Pre- requisites
- A minimum of 5 years of work experience in IT audit, security, or control-related fields (or equivalent experience).
- Familiarity with information systems concepts, security practices, and governance is beneficial.
- Basic knowledge of IT frameworks (e.g., COBIT, ISO 27001) is advantageous.
Course Content
Day 1: Information Systems Auditing Process
- Introduction to IT Auditing: Overview of the audit process, audit standards, and auditor responsibilities.
- IS Audit Standards and Guidelines: Understanding ISACA standards and best practices for auditing.
- Audit Planning and Execution: Techniques for planning, conducting, and managing IS audits.
- Risk-Based Audit Planning: Developing audit plans based on risk assessment.
- Internal Control Evaluation: Assessing and testing the effectiveness of internal controls.
- Audit Documentation and Reporting: Documenting audit findings and reporting to stakeholders.
Day 2: Governance and Management of IT
- IT Governance Frameworks: Understanding frameworks such as COBIT and their applications.
- IT Strategy and Alignment: Aligning IT with business goals and evaluating IT strategy.
- IT Risk Management: Identifying, assessing, and managing IT-related risks.
- Resource and Performance Management: Evaluating IT resource allocation, performance, and capacity planning.
- Business Continuity and Disaster Recovery: Reviewing business continuity plans (BCP) and disaster recovery plans (DRP) to ensure operational resilience.
Day 3: Information System Acquisition, Development, and Implementation
- System Acquisition and Development: Auditing the system acquisition process, including vendor selection and contract management.
- Project Management and Governance: Assessing project management practices and adherence to governance frameworks.
- Development Methodologies: Reviewing methodologies like Agile, Waterfall, and DevOps to ensure they align with organizational objectives.
- Change Management and Release Management: Auditing processes for managing system changes and releases.
- Post-Implementation Reviews: Evaluating new systems and applications to ensure they meet expected outcomes.
Day 4: Information Systems Operations, Maintenance, and Service Management
- Information Systems Operations: Auditing day-to-day operations and assessing control over processes.
- Maintenance and Patch Management: Ensuring that system maintenance and updates align with security and operational requirements.
- IT Service Management (ITSM): Reviewing practices for service delivery and incident management.
- Problem and Incident Management: Auditing processes for managing and resolving incidents and problems.
- Data Backup and Recovery: Ensuring data recovery processes meet regulatory and business requirements.
Day 5: Protection of Information Assets and Exam Preparation
- Information Asset Protection: Auditing controls related to data security, confidentiality, and privacy.
- Data Encryption and Access Control: Evaluating data protection mechanisms, including encryption and access controls.
- Physical and Environmental Security: Assessing the security of physical IT assets and environments.
- Security Awareness and Training: Reviewing employee training programs to ensure security awareness.
- Practice Exam Questions: Reviewing CISA-style questions to test knowledge and readiness.
- Exam Strategy and Tips: Providing strategies for managing exam time and answering questions effectively.
- Q&A Session: Addressing participants’ questions and clarifying key concepts.
