CISA Domain 1 Notes in 15 Minutes: The IS Audit Process, Complete Notes and Cheat Sheet

The IS audit process is the first domain of the CISA exam, and it is also the operating system everything else runs on. Domains 2 through 5 test what controls look like in specific areas; Domain 1 tests how you plan, execute, and report an audit in the first place. ISACA weights these CISA Domain 1 notes at 18% of the exam, roughly 27 of the 150 questions. That may look modest, but the concepts here, risk-based planning, evidence, sampling, and reporting, keep reappearing inside scenario questions across the other domains. First, read this note once to learn the framework. Then skim the revision box before the exam.

CISA Domain 1 notes: why the audit process comes first

Every CISA question is ultimately a judgment question: given this situation, what should the auditor do FIRST? Domain 1 gives you the playbook for answering that. It covers the full audit lifecycle, from the audit charter to follow-up, plus the standards that govern auditor behavior (ITAF and the ISACA Code of Professional Ethics). Two ideas run through the whole domain.

First, auditing is risk-based: you spend the most effort where the risk of material failure is highest, not where the paperwork is easiest. Second, the auditor stays independent and objective from planning through reporting; anything that threatens that must be disclosed. For instance, a conflict of interest, a scope limitation imposed by management, or pressure to soften a finding. Keep those two ideas in hand and most Domain 1 scenario questions start to solve themselves.

The IS audit lifecycle, end to end

Every audit follows the same six phases. The exam loves asking what happens in each phase and, more pointedly, what the auditor should do first when something goes wrong inside one.

1. Planning. Understand the business, identify risks, set the audit scope and objectives, and build the audit program. Risk assessment drives everything here.
2. Fieldwork. Execute the audit program: test controls, gather evidence, and document findings.
3. Evidence evaluation. Assess whether the evidence is sufficient (enough of it) and appropriate (relevant and reliable enough) to support conclusions.
4. Reporting. Draft findings with criteria, condition, cause, and effect; communicate them to management; issue the audit report.
5. Follow-up. Verify that management actually implemented the agreed corrective actions. The auditor follows up; management does not grade its own homework.
6. Quality assurance. Peer reviews, supervision, and methodology checks that keep the audit function itself honest.

One exam favorite sits at the boundary between phases 1 and 2. Consequently, when fieldwork uncovers a risk that planning missed, the auditor goes back and updates the risk assessment and audit program rather than continuing blindly.

CISA Domain 1 notes: worked example (the audit risk model)

Here is the calculation you should be able to do in under a minute, because the exam tests it constantly. The audit risk model says: Audit Risk = Inherent Risk x Control Risk x Detection Risk. In plain language: the risk that the auditor misses a material problem equals the risk the problem exists in the first place, times the risk that controls fail to catch it, times the risk that the auditor’s own procedures fail to detect it. Suppose your audit plan targets an overall audit risk of 5%. You assess inherent risk at 80% (a complex, judgment-heavy system) and control risk at 60% (controls exist but testing shows gaps). What detection risk can you live with?

Detection Risk = 0.05 / (0.80 x 0.60) = 0.05 / 0.48 = 10.4%. A 10.4% detection risk is low, so the audit program must rely on extensive substantive testing: larger samples, more re-performance, more independent evidence. Now flip it: if controls test strong and control risk drops to 30%, detection risk rises to 0.05 / (0.80 x 0.30) = 20.8%. As a result, the auditor can accept a higher detection risk, which means smaller samples and less substantive work. The exam trap hiding in this formula: detection risk is the ONLY component the auditor directly controls. Inherent risk and control risk exist whether or not the audit happens. When a question asks which risk the auditor “sets,” the answer is detection risk, always.

The audit risk model at a glance

Risk component	What it means	Who owns it
Inherent risk	Risk that a material error exists before any controls	Exists independently; the auditor only assesses it.
Control risk	Risk that the organization’s controls fail to prevent or detect the error	The organization’s; the auditor evaluates it through control testing.
Detection risk	Risk that the auditor’s procedures miss the error anyway	The auditor; this is the lever you adjust in the audit plan.

Risk-based audit planning

Risk-based planning is the single most tested idea in these CISA Domain 1 notes, so it is worth understanding properly. The auditor begins by understanding the organization’s business, its systems, and its risk landscape, then builds the audit plan around the areas with the highest risk of material failure. Therefore, resources follow risk, not habit.

The audit charter underpins all of this. Issued by those charged with governance (the board or audit committee), the charter establishes the audit function’s purpose, authority, and responsibility. Without a charter, the auditor has no mandate to access systems, people, or records. A classic exam question: when management refuses the auditor access to a critical system, the FIRST action is to escalate through the authority granted in the audit charter.

The audit program and audit types

Planning also produces the audit program, the step-by-step procedures the team will execute, and the engagement letter or memorandum that sets out the scope, objectives, and responsibilities agreed with management. When scope changes mid-audit, you update the program and get the change acknowledged; you do not just keep testing.

Know the four audit types, because scenario questions use them precisely: IS audit (evaluating controls over information systems); integrated audit (IT and financial auditors on one engagement); administrative audit (review of the audit function’s own efficiency); follow-up audit (verifies corrective actions from a previous audit). And the independence rule examiners return to again and again: the auditor must be independent in fact AND in appearance.

ITAF: the ISACA audit standards framework

ISACA’s IT Audit and Assurance Framework sets the professional standards for IS auditing. The standards are mandatory; the guidelines and tools/techniques support them but do not carry the same force. You do not need to memorize every standard number, but you should know what the standards cover: planning and conducting the audit engagement, performing the audit work, and reporting and communicating results. The recurring exam themes are professionalism (competence and due care), independence and objectivity, and the requirement to plan the engagement based on a risk assessment. Finally, alongside ITAF sits the ISACA Code of Professional Ethics, also mandatory: act with integrity, be objective, keep information confidential, perform work with competence and diligence.

CISA Domain 1 notes: evidence, sampling, and CAATs

Evidence is anything the auditor uses to support conclusions. Two qualities matter: sufficiency (is there enough of it?) and appropriateness (is it relevant and reliable?). In addition, when evidence from two sources conflicts, you investigate further; you do not pick the more convenient one. The reliability hierarchy is an exam staple. From most to least reliable: evidence from an independent external source, evidence obtained directly by the auditor through observation or re-performance, and evidence generated inside the organization.

The five evidence-gathering techniques: inquiry (asking), observation (watching a process run), inspection (examining documents or configurations), re-performance (independently redoing a control), and data analysis through CAATs (computer-assisted audit techniques). Re-performance gives the strongest evidence of all.

Sampling: statistical sampling uses probability theory so the auditor can quantify sampling risk; non-statistical (judgmental) sampling relies on professional judgment and cannot quantify it. Attribute sampling tests control effectiveness (pass/fail); variable sampling tests monetary amounts. Control testing uses attribute sampling; substantive testing of balances uses variable sampling. Stop-or-go sampling is for low expected deviation rates. Discovery sampling hunts for at least ONE occurrence of a rare critical event such as fraud.

CAATs: generalized audit software (GAS) analyzes entire populations; test data runs fictitious transactions through the live system; an integrated test facility (ITF) creates dummy entities inside production; parallel simulation reprocesses real data through an auditor-built copy of the system; continuous auditing and continuous monitoring shrink the time between a control failing and the organization noticing.

Audit findings and reporting

A well-written finding has four parts: criteria (what should be), condition (what is), cause (why the gap exists), and effect (what the gap costs or risks). Findings are classified: control deficiency (base case), significant deficiency (important enough to tell those charged with governance), material weakness (reasonable possibility of material misstatement). The exam’s favorite reporting scenario: management disagrees with a finding. Nevertheless, the auditor does not delete the finding. The finding stays, management’s response is recorded alongside it; however, if the disagreement is over facts, the auditor gathers more evidence. When management imposes a scope limitation, the auditor first tries to satisfy the objective another way. Ultimately, if that fails, the limitation is disclosed in the report. Then follow-up: management agrees to corrective actions with target dates, and the auditor later VERIFIES implementation. A follow-up that just asks management “did you fix it?” is not audit evidence.

Quality, ethics, and continuous auditing

Three closing themes round out these CISA Domain 1 notes. First, quality assurance: supervision of engagements, internal quality reviews, and periodic independent peer reviews. Second, the ethics duty from the ISACA code: independence, objectivity, confidentiality, and competence are mandatory, and breaches get reported up. Third, continuous auditing and continuous monitoring, shifting assurance from a once-a-year event toward ongoing, data-driven oversight using CAATs. Finally, one more exam classic: control self-assessment (CSA). Business units assess their own controls with audit facilitation. CSA improves ownership and awareness. However, it never replaces independent audit testing, because self-assessment is not independent evidence.

Exam traps that fail candidates

1. “What should the auditor do FIRST?” Answer in the spirit of the phase you are in. In planning, the first move is understanding the business and assessing risk. When evidence conflicts, the first move is more evidence, not a conclusion.
2. Detection risk confusion. Inherent and control risk exist independently of the audit. Only detection risk is the auditor’s dial.
3. Sampling mix-ups. Control testing is attribute sampling. Monetary accuracy testing is variable sampling. Low expected deviations point to stop-or-go. Hunting for one instance of fraud points to discovery sampling.
4. Independence in appearance. A technically competent audit that LOOKS compromised still fails the standard.
5. Findings vs management’s opinion. Disagreement does not delete a finding. Instead, record the response, keep the finding, add evidence if facts are disputed.
6. Evidence hierarchy under pressure. Re-performance and independent external sources beat inquiry every time.
7. Follow-up verification. “Management says it is fixed” is not audit evidence. The auditor tests the fix.

One-Page Revision: CISA Domain 1

• Domain 1 = Information Systems Auditing Process, 18% of the exam (~27 of 150 questions, 2024 job practice).
• Exam: 150 MCQs, 4 hours, scaled 200-800, passing score 450.
• Audit lifecycle: plan, fieldwork, evidence evaluation, reporting, follow-up, quality assurance.
• Risk-based planning: resources follow risk; update the risk assessment when fieldwork surprises you.
• Audit charter (from the board/audit committee) grants purpose, authority, responsibility.
• Audit Risk = Inherent Risk x Control Risk x Detection Risk; only detection risk is the auditor’s lever.
• Audit types: IS audit, integrated audit, administrative audit, follow-up audit.
• ITAF standards are mandatory; guidelines support them. ISACA Code of Professional Ethics is mandatory.
• Evidence must be sufficient and appropriate; hierarchy: independent external > auditor-observed/re-performed > internal.
• Techniques: inquiry, observation, inspection, re-performance, CAATs. Re-performance is strongest.
• Sampling: statistical (quantifies sampling risk) vs judgmental; attribute = control testing; variable = monetary testing; stop-or-go = low expected deviations; discovery = hunting one fraud instance.
• GAS analyzes full populations; test data, ITF, parallel simulation; continuous auditing shrinks detection lag.
• Finding anatomy: criteria, condition, cause, effect. Deficiency < significant deficiency < material weakness.
• Management disagreement never deletes a finding; scope limitations get disclosed.
• Follow-up verifies fixes; “management says so” is not evidence.
• Independence in fact AND appearance; CSA never replaces independent testing.
• For related reading, see the live ISA Assessment Test 2026 post, India’s own IS-audit assessment.

Found this useful? Then share it with your study group:

Share on WhatsApp | Share on Telegram