Skip to main content
Ace Skills Consulting
ISACA logoAdvanced

CISA® – Certified Information Systems Auditor

Plan and run risk-based IT audits with confidence, and prepare for the CISA exam with structured practice.

  • 32 hours of live, trainer-led sessions
  • Covers all five CISA job practice domains
  • Audit case workshops built around realistic organisations
  • Daily practice questions with explained answers
  • Full-length mock exam with domain-wise review
Aligned to ISACA exam CISA
Duration
4 Days | 32 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Advanced
Exam
CISA
Language
English

Why learn CISA with Ace Skills

  • Think like an auditor

    Learn to approach every question from the auditor's viewpoint: independence, evidence and risk, rather than the implementer's.

  • Realistic case work

    Plan engagements, test controls and write findings using sample evidence from fictional but realistic organisations.

  • Focused exam practice

    Daily question sets and a timed mock exam show you which domains need more revision before you book.

  • Career-relevant skills

    The same audit methods apply to internal audit, IT risk, compliance and Big Four assurance roles across India and the Gulf.

Course overview

Information systems auditors give boards and regulators an honest view of whether technology is controlled, secure and delivering value. That takes more than knowing frameworks: you need to plan an engagement around risk, gather sufficient evidence, judge whether controls are designed and operating well, and report findings that management will act on. This four-day course builds that way of thinking.

The plan follows the five domains of the CISA job practice. Day one covers the audit process itself: standards, risk-based planning, sampling, evidence and reporting. Day two looks at governance and management of IT, including strategy, policies, risk management, outsourcing and performance measurement. Day three examines how systems are acquired, developed and implemented, and then turns to operations, incident handling and business resilience. Day four is devoted to the protection of information assets, from identity and access to network, cloud and data security controls.

Each topic is anchored in a practical exercise. You will draft an audit plan for a mid-sized organisation, test a change management process, assess a disaster recovery arrangement and evaluate access controls from sample evidence. These workshops mirror the scenario-style questions you will meet in the exam, where the best answer depends on the auditor's role and independence.

Exam technique runs through the whole course. Every domain ends with practice questions and a discussion of why the distractors are wrong, and the final session includes a timed mock exam with a review of weak areas and a personal study plan for the weeks before you sit the exam.

This course is aligned to the CISA exam as published by ISACA. Always confirm the current job practice, eligibility rules and exam fee on the ISACA website before booking.

Key features

  • Trainer with hands-on IT audit and assurance experience
  • Domain-by-domain plan aligned to the CISA job practice
  • Case workshops: audit planning, control testing and reporting
  • Practice questions with explained answers every day
  • Timed mock exam with domain-wise feedback
  • Guidance on the experience requirement and application process
  • Course completion certificate from Ace Skills Consulting
  • Post-training doubt support while you prepare

Who should attend

  • IT and internal auditors
  • IT risk and compliance professionals
  • Information security analysts moving into assurance
  • Consultants in audit and advisory practices
  • IT managers responsible for control environments

Prerequisites

  • Working knowledge of IT infrastructure and business applications
  • Exposure to audit, risk, control or security work is strongly recommended
  • Certification requires relevant work experience as defined by ISACA

Curriculum

4 Days · 32 Hours · 16 Modules · 7 Labs

  1. Audit standards and ethics

    • ISACA standards, guidelines and code of ethics
    • Audit charter and independence
    • Types of audits and assessments
    • Business processes and controls

    Risk-based audit planning

    • Risk assessment for audit planning
    • Audit scope and objectives
    • Using frameworks to structure the work
    • Audit programmes and resourcing
    • Lab: Draft a risk-based audit plan for a fictional retailer · 60 min

    Fieldwork and evidence

    • Sampling methods
    • Evidence collection and reliability
    • Data analytics and CAATs
    • Control self-assessment

    Reporting and follow-up

    • Communicating findings
    • Writing actionable recommendations
    • Follow-up activities
    • Quality assurance of the audit function
    • Lab: Turn raw observations into audit findings · 40 min

  2. IT governance

    • Governance vs management
    • IT strategy and alignment
    • Policies, standards and procedures
    • Organisational structure and segregation of duties

    IT risk and resources

    • Enterprise risk management
    • IT resource and portfolio management
    • Vendor and outsourcing management
    • Laws, regulations and contracts
    • Lab: Assess a third-party outsourcing arrangement · 45 min

    Performance and quality

    • IT performance monitoring and reporting
    • Quality management
    • Maturity and capability models
    • Data governance basics

    Domain practice

    • Domains 1–2 practice questions
    • Reviewing distractors and auditor perspective
    • Lab: Timed question set: governance · 30 min

  3. Systems acquisition and development

    • Business case and feasibility
    • Project governance and SDLC approaches
    • Requirements and controls in design
    • Testing and implementation reviews
    • Post-implementation review

    Change and configuration

    • Change, configuration and release management
    • Migration and data conversion controls
    • Emergency changes
    • Lab: Test a change management process from sample tickets · 45 min

    IT operations

    • IT service management practices
    • Problem and incident management
    • Job scheduling and operational logs
    • Database and asset management

    Business resilience

    • Business impact analysis
    • Backup and recovery strategies
    • Business continuity and disaster recovery plans
    • Testing recovery arrangements
    • Lab: Evaluate a disaster recovery plan against a BIA · 40 min

  4. Security frameworks and privacy

    • Information asset security frameworks
    • Privacy principles
    • Physical and environmental controls
    • Security awareness

    Access and network controls

    • Identity and access management
    • Network and endpoint security
    • Cloud and virtualisation considerations
    • Encryption and key management

    Monitoring and response

    • Security event monitoring
    • Incident response management
    • Evidence collection and forensics basics
    • Data loss prevention
    • Lab: Review user access evidence and report exceptions · 45 min

    Exam readiness

    • Exam structure and time management
    • Full-length mock exam
    • Weak-area review and study plan
Download full syllabus (PDF)

Skills you will gain

  • IT audit planning
  • Risk-based auditing
  • Control testing
  • Audit sampling
  • Audit reporting
  • IT governance
  • Vendor risk
  • SDLC controls
  • Change management review
  • Business continuity
  • Disaster recovery
  • Access control review
  • Information security controls

Tools & technologies

  • Spreadsheet-based audit workpapers
  • Sample control matrices
  • Practice question bank

Certification exam

Exam details
Exam nameCertified Information Systems Auditor (CISA)
Exam codeCISA
Number of questions150
Duration240 minutes
Passing score450 / 800 (scaled)
Voucher includedNo — book directly with the vendor
Question formatMultiple choice
DeliveryOnline proctored or Test centre

Skill areas measured

  1. Information System Auditing Process
  2. Governance and Management of IT
  3. Information Systems Acquisition, Development and Implementation
  4. Information Systems Operations and Business Resilience
  5. Protection of Information Assets

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 32 hours of live, trainer-led sessions
  • 7 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 1 · 60 min

    Draft a risk-based audit plan for a fictional retailer

  • Day 3 · 45 min

    Test a change management process from sample tickets

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The ISACA certification itself is awarded by ISACA when you pass exam CISA.

Frequently asked questions

Can I take the CISA exam without audit experience?

Yes, you can sit the exam first. ISACA requires relevant work experience before it grants the certification, and some education or other credentials may count as waivers, so check the current rules on the ISACA website.

Is the exam fee included in the course?

No. You register and pay for the exam directly with ISACA, and the fee differs for ISACA members and non-members.

Is this course suitable for people from a finance audit background?

Yes. Many participants come from financial or internal audit. We explain the technology concepts in plain language and connect them to audit methods you already know.

How should I prepare after the course?

We give you a study plan based on your mock exam results. Most learners combine it with regular practice questions over the following weeks.

Can you run this course for our internal audit team?

Yes. Request a corporate quote for a private batch, and we can use case studies closer to your industry.

Related courses

Explore more

All Cybersecurity courses ISACA certifications

CISM, CISA, CRISC and COBIT are trademarks of ISACA.

Train your team on CISA

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.