Cybersecurity Audit and Compliance

CISA Exam Prep: Auditing IT Systems

Risk-based IT audit preparation with Professor David Grant

CISA Exam Prep: Auditing IT Systems logo
Quick Course Facts
20
Self-paced, Online, Lessons
20
Videos and/or Narrated Presentations
7.4
Approximate Hours of Course Media
About the CISA Exam Prep: Auditing IT Systems Course

CISA Exam Prep: Auditing IT Systems is a practical online course designed to help students build the audit mindset, technical awareness, and exam confidence needed for CISA success. Through focused lessons on governance, controls, operations, resilience, and Information Security, students learn how to evaluate IT systems using risk-based audit thinking.

Prepare Confidently For Information Security And IT Systems Auditing

  • Learn the CISA exam structure, IS auditor responsibilities, ethics, standards, and professional judgement.
  • Build practical skills in risk-based audit planning, scoping, evidence collection, sampling, testing, reporting, and follow-up.
  • Understand how to audit IT governance, data governance, vendor management, systems development, operations, and business resilience.
  • Strengthen your knowledge of Information Security controls across identity, access, networks, cloud, encryption, monitoring, forensics, and emerging technology risks.

This course provides Risk-based IT audit preparation with Professor David Grant for students preparing to audit modern IT systems and Information Security environments.

CISA Exam Prep: Auditing IT Systems guides students through the core domains of information systems auditing with clear explanations and exam-focused context. You will begin with the CISA exam structure and the mindset of an IS auditor, then progress into audit standards, ethics, risk-based planning, control objectives, audit criteria, testing methods, and communication of findings.

The course also covers governance and management of IT, including organisational structures, strategy, regulations, privacy, data governance, enterprise risk, vendor oversight, and performance monitoring. Students learn how audit work connects to business priorities, regulatory expectations, and Information Security outcomes.

Across systems acquisition, development, implementation, IT operations, change management, incident management, database audits, continuity planning, backup, and disaster recovery, you will develop a practical understanding of how controls are designed, evaluated, and improved. The Information Security lessons deepen your ability to assess asset protection frameworks, identity and access controls, network and endpoint safeguards, cloud risks, encryption, PKI, mobile, wireless, IoT, monitoring, testing, and forensic readiness.

By the end of this course, students will be better prepared to approach CISA exam scenarios with structured reasoning, connect audit evidence to risk and control objectives, and speak more confidently about auditing IT systems in real-world Information Security environments.

Course Lessons

Full lesson breakdown

Lessons are organized by topic area and each includes descriptive copy for search visibility and student clarity.

Course Foundations

1 lesson

This lesson orients learners to the CISA exam as a professional judgment exam, not a memorization test. It explains the current exam structure, the five job practice domains, and how domain weighting …

Information Systems Auditing Process

5 lessons

This lesson explains the professional foundation of the IS audit function: standards, ethics, independence, due professional care, and professional judgement. Learners connect these concepts to practi…
This lesson teaches how to plan and scope an information systems audit using a risk-based approach. You will learn how to connect audit objectives to business priorities, identify the audit universe, …
This lesson explains how IS auditors use controls, control objectives, and audit criteria to convert risk into practical audit work. You will learn the difference between the condition an auditor obse…
This lesson explains how IS auditors collect sufficient, reliable, relevant, and useful evidence, then use sampling and audit testing to support defensible conclusions. Learners will connect evidence …
This lesson covers how CISA candidates should think about audit reporting, stakeholder communication, and follow-up within the information systems auditing process. It focuses on turning evidence-base…

Governance and Management of IT

3 lessons

This lesson explains how IT governance gives direction, accountability, and oversight to technology decisions, while IT management plans and operates the IT environment within that direction. For CISA…
This lesson explains how an IT auditor evaluates policies, regulatory obligations, privacy requirements, and data governance within the broader governance and management of IT. It focuses on what CISA…
This lesson connects three governance responsibilities that CISA candidates must understand: enterprise risk management, third-party/vendor oversight, and performance monitoring. You will learn how IT…

Systems Acquisition, Development, and Implementation

3 lessons

This lesson explains how a CISA candidate should evaluate project governance before and during systems acquisition, development, and implementation. It focuses on whether projects are authorized, prio…
This lesson explains how CISA candidates should evaluate system development methods and the design of controls across acquisition, development, configuration, testing, and implementation activities. T…
This lesson focuses on the auditor’s role in determining whether a new or changed information system is ready to move into production, whether migration activities preserve data integrity and business…

Operations and Business Resilience

4 lessons

This lesson focuses on how a CISA candidate should evaluate IT operations, service management, and asset life cycle controls within a risk-based audit. It connects daily operational disciplines such a…
This lesson explains how CISA candidates should evaluate change, configuration, release, and patch management as operational controls that protect availability, integrity, security, and resilience. It…
This lesson prepares CISA candidates to audit core IT operations processes that directly affect service reliability, accountability, and evidence quality: incident management, problem management, log …
This lesson explains how a CISA candidate should evaluate business impact analysis, continuity planning, backup strategy, and disaster recovery readiness from an audit perspective. The focus is on con…

Protection of Information Assets

4 lessons

This lesson explains how an information security programme protects information assets through governance, risk alignment, classification, ownership, control selection, and continuous monitoring. It f…
This lesson covers the core preventive and detective controls CISA candidates must understand when evaluating protection of information assets: identity and access management, network security, endpoi…
This lesson focuses on security technologies and risk areas that frequently appear in CISA audit scenarios: encryption, public key infrastructure, mobile devices, wireless networks, and Internet of Th…
This lesson focuses on how CISA candidates should evaluate security monitoring, control testing, forensic readiness, and incident evidence from an audit perspective. The emphasis is not on becoming a …

Take this course at your own pace

Create a free account to enroll, keep your progress, and preview lessons — it takes 30 seconds.

Create a Free Account
About Your Instructor
Professor David Grant

Professor David Grant

Professor David Grant guides this AI-built Virversity course with a clear, practical teaching style.