ISACA CISA — Audit Process and IT Governance flashcards
10 of 68 cards free to study here · 2 topics · the whole deck is built into Willys
CISA domains 1 and 2: risk-based planning, standards, controls, evidence, sampling, CAATs and reporting, then IT governance — strategy, frameworks, enterprise architecture, risk, policy, segregation of duties, quality and maturity — plus continuity governance, which the exam tests in domain 4.
Learn deck · part of ISACA CISA · written against: CISA exam content outline (2024 job practice). Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
When building the annual risk-based IS audit plan, what should the IS auditor do first?Understand the business and its IT environment and define the audit universe, then assess the risk of each auditable area so audit effort goes to the highest risks.Auditing Process › Risk-Based Planning
-
Why does a risk-based IS audit plan serve the organization better than auditing every system on a fixed rotation?It directs limited audit resources to the areas of highest risk and adjusts as risks change, instead of spending equal effort on low-risk systems.Auditing Process › Risk-Based Planning
-
What does an internal audit charter establish for the IS audit function?Its purpose, authority and responsibilities, including unrestricted access to records, systems and people; it is approved by the board or audit committee.Auditing Process › Risk-Based Planning
-
How does an engagement letter differ from an audit charter?An engagement letter sets the scope, objectives and responsibilities for a specific engagement, typically with an external or outsourced auditor; the charter governs the internal audit function as a whole.Auditing Process › Risk-Based Planning
-
What must be settled before the IS auditor designs audit procedures for an engagement?The audit objectives and scope — procedures are chosen to gather the evidence those objectives require.Auditing Process › Risk-Based Planning
-
Who is ultimately accountable for the governance of enterprise IT?The board of directors (governing body). Executive management is responsible for running IT in line with the board's direction.IT Governance › Strategy and Frameworks
-
How does an IT strategy committee differ from an IT steering committee?The IT strategy committee works at board level and advises the board on IT strategy and alignment; the IT steering committee is an executive group that sets priorities, approves projects and oversees delivery and resources.IT Governance › Strategy and Frameworks
-
In COBIT, how is governance distinguished from management?Governance evaluates stakeholder needs, sets direction and monitors performance; management plans, builds, runs and monitors activities within that direction.IT Governance › Strategy and Frameworks
-
What is the BEST evidence that IT strategy is aligned with business strategy?IT plans and the project portfolio trace directly to business objectives, with investment decisions approved against those objectives — not just a well-written IT plan.IT Governance › Strategy and Frameworks
-
Which four perspectives does a commonly used IT balanced scorecard measure?Corporate contribution, user (customer) orientation, operational excellence and future orientation.IT Governance › Strategy and Frameworks
Unlock the whole deck
You are studying a free 10-card sample. All 68 cards of ISACA CISA — Audit Process and IT Governance, the other 2 ISACA CISA decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More ISACA CISA decks
← All ISACA CISA decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- ISACA CISA exam content outline (2024) — topic outline only; no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CISA® is a registered trademark of ISACA. This product is not affiliated with or endorsed by ISACA.
Use of these pages is covered by our Terms of Use.