Information Security Audit and Compliance

CISA Exam Prep: Auditing IT Systems

Risk-based IT audit preparation with Professor David Grant

CISA Exam Prep: Auditing IT Systems logo
Quick Course Facts
20
Self-paced, Online, Lessons
20
Videos and/or Narrated Presentations
7.4
Approximate Hours of Course Media
About the CISA Exam Prep: Auditing IT Systems Course

CISA Exam Prep: Auditing IT Systems is a practical online course designed to help students build the audit mindset, technical awareness, and exam confidence needed for CISA success. Through focused lessons on governance, controls, operations, resilience, and Information Security, students learn how to evaluate IT systems using risk-based audit thinking.

Prepare Confidently For Information Security And IT Systems Auditing

  • Learn the CISA exam structure, IS auditor responsibilities, ethics, standards, and professional judgement.
  • Build practical skills in risk-based audit planning, scoping, evidence collection, sampling, testing, reporting, and follow-up.
  • Understand how to audit IT governance, data governance, vendor management, systems development, operations, and business resilience.
  • Strengthen your knowledge of Information Security controls across identity, access, networks, cloud, encryption, monitoring, forensics, and emerging technology risks.

This course provides Risk-based IT audit preparation with Professor David Grant for students preparing to audit modern IT systems and Information Security environments.

CISA Exam Prep: Auditing IT Systems guides students through the core domains of information systems auditing with clear explanations and exam-focused context. You will begin with the CISA exam structure and the mindset of an IS auditor, then progress into audit standards, ethics, risk-based planning, control objectives, audit criteria, testing methods, and communication of findings.

The course also covers governance and management of IT, including organisational structures, strategy, regulations, privacy, data governance, enterprise risk, vendor oversight, and performance monitoring. Students learn how audit work connects to business priorities, regulatory expectations, and Information Security outcomes.

Across systems acquisition, development, implementation, IT operations, change management, incident management, database audits, continuity planning, backup, and disaster recovery, you will develop a practical understanding of how controls are designed, evaluated, and improved. The Information Security lessons deepen your ability to assess asset protection frameworks, identity and access controls, network and endpoint safeguards, cloud risks, encryption, PKI, mobile, wireless, IoT, monitoring, testing, and forensic readiness.

By the end of this course, students will be better prepared to approach CISA exam scenarios with structured reasoning, connect audit evidence to risk and control objectives, and speak more confidently about auditing IT systems in real-world Information Security environments.

Course Lessons

Full lesson breakdown

Lessons are organized by topic area and each includes descriptive copy for search visibility and student clarity.

Course Foundations

1 lesson

This lesson orients learners to the CISA exam as a professional judgment exam, not a memorization test. It explains the current exam structure, the five job practice domains, and how domain weighting …

Information Systems Auditing Process

5 lessons

Lesson 2: IS Audit Standards, Ethics, and Professional Judgement

20 min
This lesson explains the professional foundation of the IS audit function: standards, ethics, independence, due professional care, and professional judgement. Learners connect these concepts to practi…

Lesson 3: Risk-Based Audit Planning and Scoping

22 min
This lesson teaches how to plan and scope an information systems audit using a risk-based approach. You will learn how to connect audit objectives to business priorities, identify the audit universe, …

Lesson 4: Controls, Control Objectives, and Audit Criteria

21 min
This lesson explains how IS auditors use controls, control objectives, and audit criteria to convert risk into practical audit work. You will learn the difference between the condition an auditor obse…

Lesson 5: Evidence Collection, Sampling, and Audit Testing

23 min
This lesson explains how IS auditors collect sufficient, reliable, relevant, and useful evidence, then use sampling and audit testing to support defensible conclusions. Learners will connect evidence …

Lesson 6: Audit Reporting, Communication, and Follow-Up

20 min
This lesson covers how CISA candidates should think about audit reporting, stakeholder communication, and follow-up within the information systems auditing process. It focuses on turning evidence-base…

Governance and Management of IT

3 lessons

Lesson 7: IT Governance, Strategy, and Organisational Structures

22 min
This lesson explains how IT governance gives direction, accountability, and oversight to technology decisions, while IT management plans and operates the IT environment within that direction. For CISA…

Lesson 8: Policies, Regulations, Privacy, and Data Governance

23 min
This lesson explains how an IT auditor evaluates policies, regulatory obligations, privacy requirements, and data governance within the broader governance and management of IT. It focuses on what CISA…

Lesson 9: Enterprise Risk, Vendor Management, and Performance Monitoring

22 min
This lesson connects three governance responsibilities that CISA candidates must understand: enterprise risk management, third-party/vendor oversight, and performance monitoring. You will learn how IT…

Systems Acquisition, Development, and Implementation

3 lessons

Lesson 10: Project Governance, Business Cases, and Feasibility

20 min
This lesson explains how a CISA candidate should evaluate project governance before and during systems acquisition, development, and implementation. It focuses on whether projects are authorized, prio…

Lesson 11: System Development Methods and Control Design

23 min
This lesson explains how CISA candidates should evaluate system development methods and the design of controls across acquisition, development, configuration, testing, and implementation activities. T…

Lesson 12: Implementation Readiness, Migration, and Post-Implementation Review

22 min
This lesson focuses on the auditor’s role in determining whether a new or changed information system is ready to move into production, whether migration activities preserve data integrity and business…

Operations and Business Resilience

4 lessons

Lesson 13: IT Operations, Service Management, and Asset Life Cycle Controls

24 min
This lesson focuses on how a CISA candidate should evaluate IT operations, service management, and asset life cycle controls within a risk-based audit. It connects daily operational disciplines such a…

Lesson 14: Change, Configuration, Release, and Patch Management

22 min
This lesson explains how CISA candidates should evaluate change, configuration, release, and patch management as operational controls that protect availability, integrity, security, and resilience. It…

Lesson 15: Incident, Problem, Log, and Database Management Audits

24 min
This lesson prepares CISA candidates to audit core IT operations processes that directly affect service reliability, accountability, and evidence quality: incident management, problem management, log …

Lesson 16: Business Impact Analysis, Continuity, Backup, and Disaster Recovery

25 min
This lesson explains how a CISA candidate should evaluate business impact analysis, continuity planning, backup strategy, and disaster recovery readiness from an audit perspective. The focus is on con…

Protection of Information Assets

4 lessons

Lesson 17: Information Security Programmes and Asset Protection Frameworks

22 min
This lesson explains how an information security programme protects information assets through governance, risk alignment, classification, ownership, control selection, and continuous monitoring. It f…

Lesson 18: Identity, Access, Network, Endpoint, and Cloud Controls

25 min
This lesson covers the core preventive and detective controls CISA candidates must understand when evaluating protection of information assets: identity and access management, network security, endpoi…

Lesson 19: Encryption, PKI, Mobile, Wireless, and IoT Risk

21 min
This lesson focuses on security technologies and risk areas that frequently appear in CISA audit scenarios: encryption, public key infrastructure, mobile devices, wireless networks, and Internet of Th…

Lesson 20: Security Monitoring, Testing, Forensics, and Exam Scenario Strategy

24 min
This lesson focuses on how CISA candidates should evaluate security monitoring, control testing, forensic readiness, and incident evidence from an audit perspective. The emphasis is not on becoming a …
About Your Instructor
Professor David Grant

Professor David Grant

Professor David Grant guides this AI-built Virversity course with a clear, practical teaching style.