CISA Certified Information Systems Auditor Study Guide

David L. Cannon, Brian T. O'Hara, Allen Keele

• Publisher: Sybex
• Year: 2016
• ISBN:
  9781119056409
• Edition: 4
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

The ultimate CISA prep guide, with practice exams

Sybex's CISA: Certified Information Systems Auditor Study Guide, Fourth Edition is the newest edition of industry-leading study guide for the Certified Information System Auditor exam, fully updated to align with the latest ISACA standards and changes in IS auditing. This new edition provides complete guidance toward all content areas, tasks, and knowledge areas of the exam and is illustrated with real-world examples. All CISA terminology has been revised to reflect the most recent interpretations, including 73 definition and nomenclature changes. Each chapter summary highlights the most important topics on which you'll be tested, and review questions help you gauge your understanding of the material. You also get access to electronic flashcards, practice exams, and the Sybex test engine for comprehensively thorough preparation.

For those who audit, control, monitor, and assess enterprise IT and business systems, the CISA certification signals knowledge, skills, experience, and credibility that delivers value to a business. This study guide gives you the advantage of detailed explanations from a real-world perspective, so you can go into the exam fully prepared.

• Discover how much you already know by beginning with an assessment test
• Understand all content, knowledge, and tasks covered by the CISA exam
• Get more in-depths explanation and demonstrations with an all-new training video
• Test your knowledge with the electronic test engine, flashcards, review questions, and more

The CISA certification has been a globally accepted standard of achievement among information systems audit, control, and security professionals since 1978. If you're looking to acquire one of the top IS security credentials, CISA is the comprehensive study guide you need.

Chapter 1
Secrets of a Successful Auditor

---

THE OBJECTIVE OF THIS CHAPTER IS TO ACQUAINT THE READER WITH THE FOLLOWING CONCEPTS:

• 
  Understanding the foundation of IS audit standards
• 
  Understanding the auditor’s professional requirements
• 
  Familiarity of auditor skills and audit standards necessary for a successful audit
• 
  Understanding mandatory versus discretionary wording of regulations
• 
  Knowing the various types of audits
• 
  Knowing how to communicate with the auditee
• 
  Understanding auditor leadership duties, including planning and setting priorities
• 
  Understanding the organizational structure of corporations and consulting firms

In this chapter, you will study the foundation of IS audit standards. If you desire certification, the Certified Information Systems Auditor (CISA) credential establishes minimum professional requirements and defines the most basic auditor skills necessary for you to be a participant in a successful audit.

The CISA candidate is expected to know the different types of audits. There is an established process for communication with the auditee. Every successful auditor must understand their leadership duties, including planning and setting priorities. Every IS auditor is expected to recognize the difference between mandatory versus discretionary wording in regulations.

We will discuss the organizational structure of corporations and consulting firms to set the stage for understanding the minimum requirements for basic governance. The auditor will need to evaluate the organization’s governance structure to determine whether IT objectives are aligned to organizational goals. This chapter reviews simple methods for managing projects, including audit projects.

---

This chapter is a foundation for the next chapter, which is about the IS governance process. That in turn is followed by a chapter on the auditing process. Each concept we discuss will be in effect from now through the end of this study guide to progressively build your knowledge. Do not skip ahead!

---

Understanding the Demand for IS Audits

Modern business culture is moving rapidly with requirements for more visible transparency into an organization’s inner workings. With all the fraud, corruption, and controversy, there is far less trust now. Dramatically more testing is being required to reduce the chances of new and recurring insider corruption. Greed is a powerful motivator to some individuals in authority. Bad underwriting creates profits today with bonuses in executive pay, which will result in financial losses in a distant tomorrow.

Executive Misconduct

Misconduct in the executive suite usually reflects a fundamental compliance gap in corporate management. The gap commonly manifests itself as a group of executives in power. You can expect a vague expression of values that may often be different from their actual behavior. Executives commonly take risky shortcuts for profits. Alternatively, misconduct can be manifested in subsidiaries that are allowed to operate without oversight controls. This problem is compounded when their executive approach to compliance is simply a tic-the-box checklist mentality instead of ingraining compliance in a true quality culture within the daily operation of their organization. Frankly, governance and compliance is simply pushing integrity controls upon executives so they focus on more than making money.

What follows is a sampling of events that have led us to where we are today and put the spotlight on the need for corporate compliance and executive involvement:

• Italy’s Parmalat dairy scandal occurred when executives admitted that an account that claimed to be holding 4 billion euros of cash assets in Bank of America did not exist. Five of the world’s leading banks were indicted for their participation. This triggered ISO 15489 as the new standard of records management worldwide.
• Citigroup’s principal US broker subsidiary was charged by the Securities and Exchange Commission with misleading investors regarding a $1 billion collateralized debt obligation in which Citigroup bet against its investors as the housing market showed signs of distress.
• Goldman Sachs agreed to pay a record penalty of $550 million to reform its business practices. Later, former Vice President Fabrice Touree was found liable for fraud relating to his role in a synthetic (fake) collateralized debt obligation tied to subprime residential mortgages.
• John M. Cinderey of United Commercial Bank, acting under direction of his superiors, misled the outside auditors of the bank and UCBH Holdings, Inc. Charges of circumventing accounting controls, falsifying books and records, and making false or misleading statements to auditors were settled. In 2011 the SEC filed charges against CEO Thomas Wu, former COO Ebrahim Shabudin, and former EVP Thomas Yu for deliberately delaying the proper recording of loan losses as the company prepared its financial statement.
• One of the wealthiest men in the world, Raj Rajaratnam, was arrested for insider trading. His net worth is estimated at $1.3 billion. Charges allege his $21 million hedge fund scheme caused the Sri Lanka stock market to drop 4 percent.
• Bernie Madoff pled guilty to architecting a $65 billon Ponzi scheme that almost collapsed Wall Street. He admitted to depositing his clients’ money while never making any legitimate investments on their behalf. Madoff created false paperwork to convince clients and US Securities and Exchange Commission (SEC) regulators that he was engaged in legitimate trading. Several SEC auditors suggested that Madoff’s practices should be investigated. Unfortunately, SEC management ignored the auditors’ warnings, possibly because of Madoff’s former role on the SEC executive board.
• American International Group (AIG) former CFO Howard Smith overstated income by $3.9 billion (10 percent of income) and loss reserves by $500 million to quiet analyst complaints about AIG’s declining financial reserves. AIG agreed to pay over $1.6 billion in damages.
• Former US Congressman William J. Jefferson was convicted on 16 counts of bribery, racketeering, and money laundering and sentenced to 13 years in prison for accepting hundreds of thousands of dollars in bribes while in office.
• Tyco International ex-CEO Dennis Kozlowski and ex-CFO Mark H. Schwartz are serving 8 to 25 years in prison for stealing $134 million from the company. The scheme involved grand larceny, conspiracy of falsifying business records, and inflating statements of operating income by at least $500 million by using improper accounting practices.
• Lincoln Savings and Loan Association CEO Charles Keating was found guilty of causing the $2.6 billion collapse of the savings and loan industry in 1989. So far the estimated cost of the bailout is said to be over $500 billion. Keating accused the auditor of having a vendetta against him for bringing the evidence to the attention of regulators.
• WorldCom ex-CEO Bernard Ebbers is serving 25 years for securities fraud and filing false reports concerning an $11 billion accounting fraud. WorldCom triggered the creation of the US Sarbanes-Oxley Act, a corporate governance law for internal controls. CFO Scott Sullivan testified against Ebb...

Table of contents

• Cover
• Title page
• Copyright
• About the Author
• About the Contributors
• About the Technical Editor
• Introduction
• Chapter 1 Secrets of a Successful Auditor
• Chapter 2 Governance
• Chapter 3 Audit Process
• Chapter 4 Networking Technology Basics
• Chapter 5 Information Systems Life Cycle
• Chapter 6 System Implementation and Operations
• Chapter 7 Protecting Information Assets
• Chapter 8 Business Continuity and Disaster Recovery
• Appendix Answers to Review Questions
• Advert
• EULA