Domain 1 — Information Systems Auditing Process (18% · ~27 questions)

What this domain is really testing

Domain 1 is not a technical domain at all — it is a behavioural and role-clarity domain. ISACA is testing whether you think, decide, and act like an auditor rather than like an IT manager, a security engineer, or a consultant. Almost every question reduces to three judgments: (1) whose job is this? (audit vs management), (2) what is the auditor allowed to do? (standards, independence, evidence rules), and (3) what is the risk-based, proportionate next step? (plan by risk, test controls before dollars, escalate disagreement upward). Content memory matters — risk model, control types, sampling, evidence hierarchy — but the marks are usually won on role discipline. If two answers are both technically true, the correct one is normally the one that keeps the auditor independent, keeps the auditor out of design/implementation, and moves the issue to the audit committee or the board.

How the exam asks it

Two standard fallbacks when stuck:

• "Assess the risk and plan accordingly" beats any specific action.
• "Report it to the audit committee / board" beats any accommodation with management.

A. PLANNING

A1. IS audit standards, guidelines, functions and ethics

ITAF (IT Assurance Framework), 4th edition — three tiers:

Standard families:

Mnemonic for general standards — "CIO-CARD-Q": Charter, Independence, Objectivity, Competence, Audit risk & materiality, Risk-based planning, Due professional care + professional scepticism/judgment, QAIP (plus evidence, communication, use of others' work).

ISACA Code of Professional Ethics — the 7 canons, condensed:

1. Support the profession's standards — perform services with diligence and in accordance with IS auditing standards.
2. Serve the public interest, stakeholders, and the profession — maintain high standards of conduct and character.
3. Maintain privacy and confidentiality of information obtained, unless disclosure is required by law or authorised.
4. Perform duties objectively and independently; avoid conflicts of interest and disclose them; refuse anything that impairs objectivity.
5. Maintain professional competence — only accept work you are competent to do; keep skills current.
6. Do not use the relationship for personal gain; do not misrepresent results or withhold relevant information.
7. Support professional education of stakeholders so they understand IS governance and assurance.

Independence:

• Independence in fact (mindset, actual objectivity) vs independence in appearance (perception by others). Both are required — appearing compromised is as disqualifying as being compromised.
• Threats: self-review, self-interest, familiarity, intimidation, advocacy.
• The auditor must NOT design, implement, or operate controls that they will later audit — that creates a self-review threat. Advice and recommendations are fine; doing the implementation is not.
• Safeguard when independence is impaired (or perceived to be): disclose to the audit committee/board and remove or reassign the auditor from that engagement.

Audit charter — the starting point of everything:

• Formally approved by the board / audit committee (not by IT management).
• Contents: purpose and authority; scope (audit universe boundaries); reporting lines (functional reporting to the audit committee / administrative to management); responsibility and accountability; independence statement and unrestricted access to records, systems, personnel, and property; standards applied (ITAF/ISACA); engagement types covered.
• Why the charter comes FIRST: it is the source of authority. Without an approved charter there is no mandate, no access right, and no independence — so it must exist before planning, testing, or reporting. A weak charter is itself an audit finding.

Three lines model (know the direction): management owns and operates controls (1st line), risk/compliance oversight (2nd line), internal audit provides independent assurance (3rd line). An auditor who starts owning controls has crossed the line.

A2. Audit types, assessments and reviews

SOC 1 / SOC 2 Type 1 vs Type 2:

SOC 3 has no Type 1/Type 2 split — it is always a general-use summary.

Assurance ladder: Audit = highest assurance, independent, evidence-based, formal opinion, follows standards · Review = narrower scope or lower assurance · Assessment / self-assessment = often management-driven; useful input to risk assessment but not independent assurance.

A3. Risk-based audit planning

Flow: audit universe → risk assessment → risk ranking → annual audit plan → engagement planning → audit programme.

Why the auditor must NOT let management dictate scope: management selects and owns controls, so it has an incentive to steer audit away from its own weak areas. The auditor considers management's input (it is useful risk information) but sets the scope independently, and any restriction of scope is a matter for the audit committee / board — and may need to be reported.

Audit risk model:

AR = IR × CR × DR

• Residual risk = inherent risk after the effect of controls (≈ IR × CR). Controls reduce risk but never eliminate it.
• Because AR is fixed at an acceptable level and IR/CR are assessed, DR is the balancing figure. High assessed IR/CR → lower acceptable DR → more persuasive, more extensive, more timely testing.
• DR moves inversely to IR/CR. There is no "AR = IR + CR + DR" — it is multiplicative.

Levers (how testing moves):

Materiality:

• The amount/level of misstatement or control failure that would change a decision of a reasonable user.
• Inversely related to sample size — tighter materiality, bigger sample.
• Directly tied to audit risk: lower materiality threshold ⇒ lower tolerable error ⇒ must detect smaller problems ⇒ more work.
• Defined both for the engagement (planning) and for individual findings (reportable threshold). Performance materiality is set below overall materiality to allow for undetected error.

A4. Control types and considerations

By purpose:

By nature: Administrative (policies, procedures, segregation of duties, training, supervision) · Technical/logical (access control, authentication, encryption, automated validation, logging) · Physical (locks, guards, badges, environmental controls, media storage).

General controls vs application controls:

Application control examples — map each to prevent vs detect:

The trap: validation-style input edits (check digit, limit, range, validity, completeness) are preventive. Counting/summing/comparing after processing (hash total, record count, batch total, sequence, parity, echo, reconciliation, exception report) is detective. Deterrent ≠ preventive; recovery ≠ corrective (recovery restores service, corrective fixes the data/condition).

B. EXECUTION

B1. Audit project management

Working paper quality test: could another competent auditor, with no prior knowledge, re-perform the work and reach the same conclusion?

B2. Audit testing and sampling methods

Compliance (control) testing vs substantive testing:

• Engagement sequence: understand the process → assess risk → test controls (compliance) → if controls are effective, reduce substantive work; if controls fail, expand substantive testing.
• Failure of a control test does not mean the data is wrong — it means control risk is higher, so detection risk must fall (more/better substantive work).
• Substantive testing is never eliminated by good controls when IR is high, or when a significant risk exists.

Sampling — core vocabulary:

Statistical vs non-statistical:

Attribute vs variable:

Attribute sampling variants (memorise the orientation):

Every lever that increases sample size: higher confidence level · tighter (smaller) precision · lower tolerable error/deviation rate · higher expected error rate · larger/higher-value population · lower materiality · higher assessed inherent or control risk (lower DR) · more strata handled separately rather than pooled · non-statistical where no reliable model exists.

B3. Audit evidence collection techniques

Sufficiency vs appropriateness:

• Sufficiency = quantity (driven by risk, materiality, quality of evidence).
• Appropriateness = relevance (bears on the specific objective) + reliability (trustworthiness).
• More evidence does not fix irrelevant evidence.

Reliability hierarchy — MOST to LEAST reliable:

1. Auditor's direct observation, inspection, and re-performance (highest)
2. Externally generated evidence held by the auditor (e.g. bank confirmation returned to the auditor)
3. Externally generated evidence held by the client (e.g. vendor invoice, supplier statement)
4. Internally generated evidence under strong control
5. Internally generated evidence under weak control
6. Oral evidence and management representations (lowest)

Supporting rules:

• Documentary > oral. Written management representation is weak and never a substitute for other evidence.
• Original > copy/fax/scan; system-generated with reliable audit trail > manually prepared.
• Independent source > the auditee's own assertion.
• Corroborating evidence — two or more independent sources agreeing strengthens the conclusion; conflicting evidence must be resolved, not ignored.
• Analytical procedures are used: in planning (risk identification, unexpected relationships), as substantive procedures (comparisons, ratios, trend and reasonableness tests, regression), and in final review (overall reasonableness). They are most effective where relationships are predictable, stable, and plausible — high-volume, routine, non-discretionary transactions. Weak where transactions are discretionary, non-recurring, or estimates.
• Techniques: inquiry, observation, inspection of documents, re-performance, recalculation, confirmation, analytical review, CAATs, physical examination, walkthrough.

B4. Audit data analytics

CAAT categories:

CAAT advantages: full-population (not sample) testing → eliminates sampling risk; faster and cheaper per test; repeatable/re-runnable; deeper analysis (stratification, Benford-type patterns, duplicates); better coverage of remote/online systems. CAAT risks/constraints: IT cooperation needed (access, file layouts, scheduling); possible production-data contamination (test data, ITF); data extraction may be incomplete or unverified; version/schema changes break scripts; auditor must be competent in the tool; source-code access may be restricted. Mitigations: validate the extract (record counts, control totals, reconcile to source), keep the extraction read-only, secure/destroy sensitive extracts per policy, and document the query or script so results are repeatable.

B5. Reporting and communication techniques

The 5 Cs of a finding:

Opinion types (audit/assurance reporting):

Communication:

• Interim (progress) report — issued during the engagement for significant issues requiring immediate management attention; does not pre-empt the final report.
• Exit / closing meeting — findings, criteria, and management responses are discussed and validated with the auditee; reduces factual dispute; not a negotiation of the facts.
• Management response — owner, action, target date; included in the report as received (with the auditor's view if it differs).
• Final report — issued on a timely basis to those charged with governance; contains objectives, scope, period, criteria, findings with the 5 Cs, overall opinion, and management responses; distribution restricted to the audit committee/board and responsible management, mindful of confidentiality and regulatory disclosure.

When management accepts the risk instead of remediating:

1. The auditor does not accept the risk — the auditor has no authority to accept risk on behalf of the organisation.
2. Document the finding, the assessed risk, and the fact that management acknowledged and accepted it.
3. Escalate to the audit committee / board (those charged with governance) — this is a residual risk acceptance decision at the right level, and potentially a risk-management finding in its own right.
4. If the risk is from a control failure or a pervasive issue, the auditor may need to modify the opinion and/or report to the board.
5. Where laws/regulations are breached, consider obligations for regulatory reporting — and be aware of the ethics canon on confidentiality and legal disclosure.

B6. Quality assurance and audit process improvement

QAIP (Quality Assurance and Improvement Program):

Fraud (cross-cutting)

TRAPS — how ISACA makes Domain 1 tricky

1. "The auditor should NOT design or implement the control." Any answer offering to build, configure, or operate a control creates a self-review threat → wrong, unless the role is explicitly advisory and the auditor will not audit it.
2. Best answer = the AUDIT activity, not the MANAGEMENT activity. "Recommend", "assess", "test", "report", "obtain evidence" beat "implement", "enforce", "approve", "fix", "configure", "train users".
3. "Report to the audit committee / board" is almost always the right final step for: unresolved findings, management risk acceptance, scope limitations, suspected fraud, and independence impairment.
4. Management cannot "accept" the auditor's risk away. The auditor reports; management owns and accepts risk; the board/governance is informed. The auditor never simply drops the issue.
5. The auditor does not let management set the scope. Management input is risk information; scope is audit's, and restrictions are escalated. A scope restriction the auditor cannot remove can force a disclaimer/qualified opinion.
6. Detection risk is the only risk the auditor controls — via nature, timing, extent. IR and CR are assessed, never set by the auditor. Memorise: AR = IR × CR × DR (multiply, never add).
7. Direction confusion on sampling. Higher confidence, tighter precision, lower tolerable rate, higher expected error rate, lower materiality → bigger sample. Getting the direction backwards is the single most common Domain 1 arithmetic error.
8. Block sampling is the weakest (least representative). Stratified is generally preferred over simple random when the population is heterogeneous, because it lowers sample size for the same confidence.
9. Prevent vs detect. Check digit, limit, range, validity, completeness = preventive. Hash total, record count, batch control total, sequence, parity, echo, reconciliation, exception report = detective. Deterrent ≠ preventive; recovery ≠ corrective.
10. General controls first. Weak ITGCs mean application controls cannot be relied on — the auditor expands testing rather than concluding controls are effective.
11. SOC 2 Type 1 = design as of a date; Type 2 = operating effectiveness over a period. SOC 3 is a general-use summary with no detailed test results. A SOC 2 report does not remove the user auditor's responsibility — check the period, the criteria, and whether the provider's complementary user entity controls are actually in place.
12. Sampling risk vs non-sampling risk. Sampling risk can be quantified and reduced by sample size; non-sampling risk is a human/method error — a bigger sample does not fix it.
13. Sufficiency ≠ appropriateness. Volume does not cure irrelevance. Oral and management-representation evidence is the weakest.
14. Control test failure ⇒ expand SUBSTANTIVE testing, and consider raising assessed control risk (lowering DR). It does not automatically mean the account balance is misstated.
15. Compliance testing = controls (attribute, yes/no). Substantive testing = amounts (variable, monetary).
16. The 5 Cs must all be present. Missing criteria = no finding. Missing cause = the same finding recurs. Never write the recommendation as management's action plan.
17. Fraud: the auditor's job is not to detect fraud — due professional care + scepticism + fraud risk consideration. Picking "audit must detect all fraud" or "guarantee" is always wrong.
18. Test data contaminates production. ITF uses a dummy entity in the live system; SCARF/embedded audit modules must be designed in during the SDLC.
19. Charter authority comes from the BOARD/audit committee, not IT management. Reporting line is functional to the audit committee.
20. External QAIP review is at least every 5 years and must be independent — self-assessment alone never satisfies it.
21. Independence in fact AND in appearance are both required; a genuine absence of bias with a visible conflict is still a problem.
22. Pre-implementation vs post-implementation: pre = will it meet objectives (design/readiness, before go-live); post = did it deliver the benefits. Do not swap their purposes.
23. Working papers must let another auditor re-perform the work. "The auditor recalls testing it" is never sufficient evidence.
24. Follow-up is mandatory, not optional or management-driven: validate that remediation actually works, then close the finding — and reopen or re-report if it does not.

60-second recall — absolute must-memorise facts

• Domain 1 = 18% of the exam, roughly 27 of 150 questions; exam is 150 MCQs / 240 minutes / scaled 200–800 / pass 450.
• ITAF 4th ed.: Tier 1 Standards (must/shall, mandatory) → Tier 2 Guidelines (should) → Tier 3 Tools & Techniques (informative).
• General standards: charter, independence, objectivity, competence, professional scepticism & judgment, due professional care, QAIP, risk-based planning, materiality, evidence, communication, use of others' work.
• 7 ethics canons: standards · public interest · confidentiality · objectivity & independence (disclose conflicts) · competence · no personal gain/misrepresentation · support professional education.
• Never design or implement what you will audit (self-review threat). Independence in fact and in appearance.
• Audit charter originates from the board/audit committee — it comes first because it grants authority, access, and independence.
• Audit risk: AR = IR × CR × DR. Auditor controls DR only, through nature, timing, extent.
• Residual risk = risk remaining after controls (IR × CR effect). Controls reduce, never eliminate.
• Higher IR/CR ⇒ lower DR ⇒ more effective, better-timed, more extensive testing.
• Lower materiality, higher confidence, tighter precision, lower tolerable error, higher expected error ⇒ LARGER sample.
• Sampling risk (alpha = too much work, beta = too little) is quantifiable; non-sampling risk is human and is not fixed by sample size.
• Attribute = compliance (yes/no). Variable = substantive (amounts). Stop-or-go and discovery assume low expected error. Block sampling is weakest.
• Preventive: access control, SoD, approval, validation edits (check digit, limit, range, validity, completeness), encryption, physical locks.
• Detective: hash total, record count, batch control totals, sequence check, parity, echo check, exception report, reconciliation, audit trail review.
• Corrective = fix data/condition; Recovery = restore service/operations; Deterrent = discourage; Compensating = substitute.
• General controls pervasive and prerequisite; application controls = input / processing / output. Weak ITGC ⇒ cannot rely on application controls.
• Evidence reliability, best → worst: auditor's direct observation/re-performance → external held by auditor → external held by client → internal under strong control → internal under weak control → oral/management representation.
• Sufficiency = quantity. Appropriateness = relevance + reliability.
• Compliance testing first; if controls fail, EXPAND SUBSTANTIVE testing.
• 5 Cs: Criteria, Condition, Cause, Consequence, Corrective action/recommendation.
• Opinions: unqualified · qualified · adverse · disclaimer (scope limitation).
• Management accepts the risk ⇒ auditor documents and ESCALATES to the audit committee; auditor cannot accept risk.
• CAATs: GAS (ACL/IDEA) · test data (contamination risk) · ITF (dummy entity in live system) · parallel simulation · embedded audit module/SCARF (real-time exception capture, designed in SDLC) · snapshot · mapping/tracing · source code review.
• SOC 1 = ICFR-relevant controls · SOC 2 = Trust Services Criteria (Type 1 = design at a date, Type 2 = operating effectiveness over a period) · SOC 3 = general-use summary, no detailed test results.
• Pre-implementation review = will it meet objectives; post-implementation review = did it deliver the benefits.
• Fraud: auditor must apply due professional care and consider fraud risk — NOT responsible for detecting fraud. Chain of custody: document every transfer, image with write-blockers and hashes, work on copies.
• QAIP: internal ongoing + periodic self-assessment; independent EXTERNAL assessment at least every 5 years.
• Follow-up is mandatory: validate remediation, then close the finding.
• When two answers are both true: choose the audit activity, not the management activity — and escalate upward, never sideways into ownership.