ISACA CISA: key terms

Flashcards for this exam ISACA CISA guide Class dates

• Access ReviewPeriodic verification by managers or owners that users' access rights are still appropriate.Intermediate
• Agreed-Upon Procedures (AUP)Engagement in which a practitioner performs specific procedures agreed with the client and reports factual findings without an opinion.Advanced
• Application ControlsControls built into business applications to ensure complete, accurate, and valid processing of transactions.Foundational
• Assessment MethodsThe three NIST assessment methods: examine (review artifacts), interview (discuss with people), and test (exercise mechanisms).Intermediate
• AssuranceObjective examination of evidence to provide an independent assessment of governance, risk, and control.Intermediate
• Attribute SamplingStatistical sampling method used in compliance testing to estimate the rate of occurrence of a characteristic.Intermediate
• Audit CharterFormal document defining internal audit's purpose, authority, responsibility, and accountability.Foundational
• Audit CommitteeBoard committee of independent directors overseeing financial reporting, internal control, and audit functions.Foundational
• Audit EvidenceInformation used by auditors to arrive at conclusions on which opinions are based.Foundational
• Audit FindingDocumented result of an audit describing a condition that deviates from criteria, with cause, effect, and recommendation.Foundational
• Audit Follow-UpProcess of verifying that management has implemented agreed corrective actions from audit findings.Intermediate
• Audit HooksEmbedded triggers in application software that flag suspicious transactions for auditor attention.Advanced
• Audit ObjectiveSpecific goal an audit aims to achieve, such as confirming controls meet a control objective.Foundational
• Audit OpinionAuditor's conclusion on the subject matter: unmodified, qualified, adverse, or disclaimer.Intermediate
• Audit PlanDocument setting out the audits to be performed over a period, or the approach for a specific engagement.Foundational
• Audit ProgramStep-by-step procedures auditors follow to gather evidence and achieve audit objectives.Intermediate
• Audit ReportFormal communication of audit objectives, scope, findings, conclusions, and recommendations.Foundational
• Audit RiskRisk that the auditor reaches an incorrect conclusion, such as issuing an unqualified opinion when material errors exist.Intermediate
• Audit SamplingApplying audit procedures to less than 100 percent of a population to draw conclusions about the whole.Foundational
• Audit ScopeBoundaries of an audit: the systems, locations, processes, period, and organizational units covered.Foundational
• Audit TrailChronological record of system activities that allows reconstruction of events and accountability.Foundational
• Audit UniverseComplete inventory of auditable entities, processes, systems, and risks in an organization.Intermediate
• Auditor IndependenceFreedom from conditions that threaten the auditor's ability to perform work objectively, in fact and in appearance.Foundational
• Balanced Scorecard (BSC)Performance management tool measuring strategy across financial, customer, internal process, and learning and growth perspectives.Intermediate
• Batch ControlsControls that group transactions and use totals to verify completeness and accuracy of processing.Intermediate
• Bridge LetterLetter from a service organization covering the gap between the end of its SOC report period and a later date.Advanced
• Business CaseDocumented justification for an investment, describing benefits, costs, risks, and alignment with objectives.Intermediate
• Business Continuity Planning (BCP)Planning to keep essential business functions operating during and after a disruption.Foundational
• Business Impact Analysis (BIA)An analysis that identifies critical business functions and the impact of their disruption over time.Foundational
• Capability Maturity Model Integration (CMMI)Process improvement model defining maturity and capability levels from initial to optimizing.Intermediate
• Cardholder Data Environment (CDE)People, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus connected systems.Intermediate
• Certification AuditIndependent third-party audit by an accredited certification body to certify a management system, such as ISO/IEC 27001.Intermediate
• Check DigitExtra digit calculated from other digits of a number to detect transcription and transposition errors.Intermediate
• CIS Critical Security Controls (CIS Controls)Prioritized set of 18 cybersecurity safeguard groups from the Center for Internet Security.Foundational
• COBITISACA framework for governance and management of enterprise information and technology.Intermediate
• COBIT Management DomainsFour COBIT management domains: Align, Plan and Organize; Build, Acquire and Implement; Deliver, Service and Support; Monitor, Evaluate and Assess.Intermediate
• Cold SiteAn alternate facility with basic infrastructure such as power and space but no ready equipment or data.Foundational
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• Complementary User Entity Controls (CUEC)Controls a service organization assumes its customers will implement for the overall control objectives to be met.Intermediate
• Compliance TestingAudit testing to determine whether controls are being applied in compliance with policies and procedures.Foundational
• Computer-Assisted Audit Techniques (CAAT)Tools and techniques using computers to automate audit procedures such as data extraction and analysis.Intermediate
• Confidence CoefficientProbability that a sample result correctly represents the population, such as 95 percent.Advanced
• Continuous AuditingPerforming audit procedures on an automated, frequent, or real-time basis.Intermediate
• Continuous Control Monitoring (CCM)Automated, ongoing testing of controls using system data to identify failures quickly.Intermediate
• Control Design EffectivenessWhether a control, if operated as described, would prevent or detect the risk it addresses.Intermediate
• Control EnvironmentThe set of standards, processes, and structures, including tone at the top, that provide the basis for internal control.Intermediate
• Control MappingLinking controls to multiple framework or regulatory requirements to enable test-once, comply-many approaches.Intermediate
• Control ObjectiveStatement of the desired result or purpose to be achieved by implementing controls.Foundational
• Control OwnerPerson accountable for designing, operating, and maintaining a specific control.Intermediate
• Control RiskRisk that a material error will not be prevented or detected in a timely manner by internal controls.Intermediate
• Control Self-Assessment (CSA)Process in which management and staff evaluate the effectiveness of their own controls.Intermediate
• Control TestingEvaluating whether controls are designed and operating effectively through inquiry, inspection, observation, and reperformance.Intermediate
• Corporate GovernanceThe system of rules, practices, and processes by which a board directs and controls an organization on behalf of stakeholders.Foundational
• Corrective ActionAction to eliminate the cause of a nonconformity or incident and prevent recurrence.Intermediate
• Corrective ControlControl that reduces the impact of an event or restores systems after it occurs.Foundational
• COSO ERM FrameworkCOSO's enterprise risk management framework integrating risk with strategy and performance.Advanced
• COSO Internal Control Integrated FrameworkWidely used framework for designing and evaluating internal controls, with five components and 17 principles.Intermediate
• Data Analytics in AuditingUse of data analysis tools to test entire populations, identify anomalies, and support risk assessment.Intermediate
• Detection RiskRisk that the auditor's procedures fail to detect a material error or misstatement.Intermediate
• Detective ControlControl that identifies and records an undesired event after or while it occurs.Foundational
• Disaster Recovery Plan (DRP)A documented plan for restoring IT systems, data and infrastructure after a disruptive event.Foundational
• Discovery SamplingAttribute sampling used to find at least one instance of a critical error, such as fraud, if it exists above a given rate.Advanced
• Due Professional CareApplying the care and skill expected of a reasonably prudent and competent auditor.Intermediate
• Embedded Audit Module (EAM)Audit code built into an application to capture selected transactions for auditor review.Advanced
• Engagement LetterDocument defining an audit or assurance engagement's objectives, scope, responsibilities, and terms.Intermediate
• Enterprise Governance of IT (EGIT)Governance of information and technology that ensures IT enables enterprise goals, optimizes risk and resources, and delivers value.Intermediate
• Evaluate, Direct and Monitor (EDM)COBIT governance domain in which the governing body evaluates options, directs management, and monitors performance.Intermediate
• Exit MeetingClosing meeting where auditors discuss findings and recommendations with auditees before final reporting.Intermediate
• External AuditAudit performed by an independent party outside the organization, such as a CPA firm or certification body.Foundational
• Fraud RiskRisk of intentional deception for gain, including asset misappropriation, corruption, and financial statement fraud.Intermediate
• Full Interruption TestA disaster recovery test that shuts down the primary site and moves operations completely to the recovery site.Intermediate
• Generalized Audit Software (GAS)Audit software that reads and analyzes data files to perform functions like sampling, stratification, duplicate detection, and gap detection.Intermediate
• Global Internal Audit StandardsIIA standards effective January 2025 that govern the professional practice of internal auditing worldwide.Advanced
• Hash TotalSum of a non-financial field, such as account numbers, used solely as a batch control.Advanced
• HITRUST CSFCertifiable security and privacy framework harmonizing HIPAA, NIST, ISO, PCI, and other requirements, widely used in healthcare.Intermediate
• Hot SiteA fully equipped alternate facility with current systems and data that can take over operations almost immediately.Foundational
• Identity Governance and Administration (IGA)Discipline and tools for managing identity lifecycle, access requests, certifications, and policy compliance.Advanced
• Information Security Management System (ISMS)Systematic, risk-based management system for protecting information through policies, processes, and controls.Foundational
• Inherent RiskLevel of risk before any controls or treatments are applied.Intermediate
• Input ControlsApplication controls ensuring data entered is authorized, complete, accurate, and valid.Intermediate
• Integrated Test Facility (ITF)Technique creating dummy entities in a production system so test transactions are processed alongside live data.Advanced
• Internal AuditIndependent, objective assurance and consulting activity within an organization that evaluates governance, risk management, and control.Foundational
• Internal ControlProcess designed to provide reasonable assurance about achieving objectives in operations, reporting, and compliance.Foundational
• ISACA IT Audit Framework (ITAF)ISACA's professional practices framework containing IS audit and assurance standards, guidelines, and tools.Advanced
• ISAE 3402International assurance standard for reports on controls at service organizations, equivalent to SOC 1.Advanced
• ISO 22301International standard specifying requirements for a business continuity management system (BCMS).Intermediate
• ISO/IEC 27001International standard specifying requirements for establishing, implementing, maintaining, and improving an information security management system.Foundational
• ISO/IEC 27002Code of practice providing guidance on implementing information security controls.Intermediate
• ISO/IEC 38500International standard providing principles for the governance of IT by boards and governing bodies.Advanced
• IT General Controls (ITGC)Controls over the IT environment that support the reliable operation of applications, such as access, change, and operations.Foundational
• Job RotationPeriodically moving staff between roles to reduce fraud risk, detect misuse, and cross-train employees.Foundational
• Judgmental SamplingNonstatistical sampling in which the auditor selects items based on experience and judgment.Intermediate
• Key Control Indicator (KCI)Metric that measures how well a specific control is operating.Intermediate
• Legal HoldA directive to preserve all potentially relevant information when litigation or investigation is reasonably anticipated.Foundational
• Mandatory VacationPolicy requiring employees to take consecutive days off so others can perform their duties and uncover fraud.Foundational
• Material WeaknessDeficiency in internal control such that a material misstatement may not be prevented or detected timely.Advanced
• MaterialitySignificance of an item or error such that it could influence decisions of users of audit results.Intermediate
• Maximum Tolerable Downtime (MTD)The longest period a business function can be unavailable before causing unacceptable or irrecoverable harm.Intermediate
• Mean Time Between Failures (MTBF)The average operating time between failures of a repairable system, a measure of reliability.Foundational
• Mean Time to Repair (MTTR)The average time required to repair a failed component or system and return it to service.Foundational
• NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)Voluntary NIST framework (Feb 2024) organizing cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.Foundational
• NIST SP 800-53NIST catalog of security and privacy controls for information systems and organizations.Intermediate
• NIST SP 800-53ANIST guide for assessing security and privacy controls, defining assessment procedures and methods.Advanced
• NonconformityNon-fulfillment of a requirement of a standard, regulation, or the organization's own management system.Intermediate
• Operating EffectivenessWhether a control operated consistently as designed throughout a specified period.Intermediate
• Output ControlsApplication controls ensuring output is complete, accurate, and distributed only to authorized recipients.Intermediate
• Parallel SimulationAuditor processes real production data with auditor-controlled programs and compares results to production output.Advanced
• Parallel TestA disaster recovery test in which recovery systems are brought up at the alternate site and run alongside production without interrupting it.Intermediate
• Payment Card Industry Data Security Standard (PCI DSS)Industry standard with 12 requirements for protecting payment account data, maintained by the PCI Security Standards Council.Foundational
• Plan-Do-Check-Act (PDCA)Iterative four-step management cycle for continual improvement: plan, do, check, act.Foundational
• PopulationEntire set of items from which an audit sample is drawn.Intermediate
• Post-Implementation Review (PIR)Review after a system or project goes live to assess whether objectives and benefits were achieved.Intermediate
• Preventive ControlControl designed to stop an undesired event from occurring.Foundational
• Processing ControlsApplication controls ensuring data is processed completely and accurately.Intermediate
• Professional SkepticismAttitude of a questioning mind and critical assessment of audit evidence.Intermediate
• Public Company Accounting Oversight Board (PCAOB)Nonprofit created by SOX to oversee audits of US public companies and set auditing standards.Advanced
• Qualified Security Assessor (QSA)Assessor company or employee certified by the PCI SSC to perform PCI DSS assessments.Intermediate
• Recovery Point Objective (RPO)Maximum acceptable amount of data loss measured in time before a disruption.Foundational
• Recovery Time Objective (RTO)Maximum acceptable time to restore a service after a disruption.Foundational
• ReperformanceAuditor independently executes a control or procedure to verify it operates as described.Intermediate
• Report on Compliance (ROC)Detailed PCI DSS assessment report documenting how each requirement is met, completed by a QSA or ISA.Intermediate
• Right to Audit ClauseContract provision allowing a customer or regulator to audit a vendor's controls, records, and facilities.Intermediate
• Risk-Based Audit ApproachAudit planning approach that focuses resources on areas of highest risk.Foundational
• RMF Assess StepRMF step where an assessor determines whether controls are implemented correctly, operating as intended, and producing desired outcomes.Intermediate
• Root Cause Analysis (RCA)A structured investigation to identify the underlying causes of an incident so they can be eliminated.Foundational
• Sampling RiskRisk that the auditor's conclusion based on a sample differs from the conclusion if the entire population were tested.Intermediate
• Sarbanes-Oxley Act (SOX)2002 US law requiring public companies to maintain and attest to internal control over financial reporting.Foundational
• Scope LimitationRestriction that prevents the auditor from performing necessary procedures or obtaining sufficient evidence.Intermediate
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
• Security QuestionnaireStandardized set of questions used to assess a third party's security and privacy controls.Intermediate
• Security Steering CommitteeCross-functional management group that prioritizes security initiatives, resolves conflicts, and aligns security with business needs.Intermediate
• Segregation of Duties (SoD)Dividing critical tasks among different people so no single person can both commit and conceal errors or fraud.Foundational
• Separation of Duties (SoD)Dividing a critical task among multiple people so no single individual can complete it alone.Foundational
• Significant DeficiencyControl deficiency less severe than a material weakness but important enough to merit attention of those charged with governance.Advanced
• Snapshot TechniqueContinuous audit technique capturing images of a transaction at selected points as it flows through an application.Advanced
• SOC 1Report on a service organization's controls relevant to user entities' internal control over financial reporting.Intermediate
• SOC 2Report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy.Foundational
• SOC 3General-use summary report of a SOC 2 examination suitable for public distribution.Intermediate
• SOC Type 1 ReportSOC report on the fairness of the description and suitability of control design as of a specific date.Foundational
• SOC Type 2 ReportSOC report covering both design and operating effectiveness of controls over a specified period.Foundational
• SOX Section 302SOX provision requiring CEOs and CFOs to certify the accuracy of financial reports and effectiveness of disclosure controls.Intermediate
• SOX Section 404SOX provision requiring annual management assessment of ICFR and, for accelerated filers, external auditor attestation.Intermediate
• Statement on Standards for Attestation Engagements No. 18 (SSAE 18)AICPA attestation standard under which SOC 1, SOC 2, and SOC 3 examinations are performed.Advanced
• Statistical SamplingSampling that uses random selection and probability theory to evaluate results and quantify sampling risk.Intermediate
• Stop-or-Go SamplingAttribute sampling technique that allows the auditor to stop testing early if few or no errors are found.Advanced
• Stratified SamplingDividing a population into homogeneous subgroups (strata) and sampling from each.Advanced
• Subservice OrganizationVendor used by a service organization whose controls may be relevant to the service organization's customers.Advanced
• Substantive TestingAudit testing that examines the integrity of actual data, balances, or transactions to detect material errors.Foundational
• Sufficient Appropriate EvidenceAudit evidence that is adequate in quantity and of suitable quality to support conclusions.Intermediate
• System and Organization Controls Report (SOC report)AICPA attestation report by a CPA on controls at a service organization.Foundational
• Test DataAuditor-prepared transactions processed through an application to verify controls and logic.Advanced
• Third-Party Risk Management (TPRM)Discipline of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, and other external parties.Foundational
• Three Lines ModelIIA model describing governance roles: management (first and second lines), internal audit (third line), and the governing body.Intermediate
• Tolerable Error RateMaximum error rate an auditor will accept while still concluding a control or balance is acceptable.Advanced
• Trust Services Criteria (TSC)AICPA criteria for security, availability, processing integrity, confidentiality, and privacy used in SOC 2 and SOC 3.Intermediate
• Variable SamplingStatistical sampling method used in substantive testing to estimate a monetary or numeric value.Intermediate
• Vendor Due DiligencePre-contract evaluation of a vendor's security, privacy, financial, operational, and compliance posture.Intermediate
• WalkthroughFollowing a transaction from origination through processing and reporting to understand and confirm a process and its controls.Intermediate
• Warm SiteAn alternate facility with some equipment and connectivity in place but requiring data restoration and configuration before use.Foundational