Reviews 4,2
Reviews 4,5
Certified Information Systems Auditor (CISA)
Auditing IT systems requires more than technical knowledge – it demands a structured approach to assessing risks, evaluating controls, and ensuring that governance frameworks actually work. The CISA program builds exactly this kind of professional competence.
Key topics
- Conducting IT audits using risk-based methodologies.
- Applying governance principles, compliance frameworks, and internal controls.
- Protecting information assets and meeting data privacy requirements.
- Assessing the quality and maturity of IT processes and system landscapes.
- Understanding and navigating regulatory and legal requirements.
- Incorporating emerging technologies and automation into audit practices.
Prerequisites
A foundational understanding of IT, information systems, or business processes is helpful, along with some exposure to a professional IT environment.
Target group
Professionals from IT, audit, compliance, risk management, and consulting who want to develop a systematic, standards-based approach to IT auditing and control.
CISA-level expertise creates a foundation for responsible, well-informed action in complex digital business environments – and opens doors to recognized roles in audit, governance, and risk management worldwide.
Course content
IS audit process fundamentals
- ISAAS (IS audit standards)
- Governance of audit procedures
- KGI, CSF, KPI, KRI
- ALE, RTO, RPO, SDO, MTO, MTD, AIW
- Understanding risk appetite, tolerance, and capacity
- Assessing threats and control mechanisms
- Risk management in the audit context
- Methods of spot-check auditing
- IS auditor duties in the audit process
IT governance and management essentials
- HR processes and IT staffing
- Outsourcing and sourcing strategies
- Cloud computing in enterprise IT
- CAPEX and OPEX in IT budgeting
- Overview of BCP, DRP, and BIA
- Testing business continuity and recovery plans
- Enterprise architecture and IT strategy
- Corporate governance and IT control
- Developing an information security policy
- Established IT management practices
- IT organizational structures and responsibilities
- IS auditor duties in governance and management
System acquisition and implementation review
- Defining roles and responsibilities (including RACI matrix)
- HR processes and their impact on security strategy
- Outsourcing: addressing security-relevant aspects
- Cloud computing and necessary security measures
- Understanding and differentiating CAPEX and OPEX
- BCP, DRP, and BIA: key concepts and relationships
- Systematically testing emergency plans
- Enterprise architecture in a security context
- Corporate governance and its security relevance
- Developing and implementing an information security policy
- Applying IT management practices for security
- Clarifying IT organizational structures, roles, and responsibilities
- IS auditor duties in security monitoring and management
System operations and service management review
- Managing and operating information systems
- Understanding hardware architectures
- Deploying and administering operating systems
- Database structures and organization
- Using and integrating third-party software
- Building and maintaining network infrastructure
- Core internet concepts and technologies
- Telecommunications systems and their applications
- IS auditor duties in operations and service management
Protecting information assets
- Classifying and protecting assets
- Promoting security awareness and conducting training
- Securely integrating external parties
- Measures against computer crime
- Implementing access control and access management
- Defining remote access regulations
- Establishing media handling procedures
- Securing the network infrastructure
- Deploying firewalls effectively
- Using intrusion detection systems
- Applying encryption technologies
- Planning and evaluating penetration tests
- Considering environmental factors
- Implementing data leakage prevention (DLP)
- Controlling physical access
- IS auditor role in protecting information assets
Up to 100% funding for your continuing education
Attractive funding opportunities are available for numerous continuing education programs – depending on the funding program, up to 100% funding is possible.
The requirement is that you live or work in Germany. Our funding opportunities are not available outside of Germany.
Funding opportunities are available for career starters, job seekers, career changers, startups, experienced professionals, those seeking career advancement, and specialists.
What does CISA certification stand for?
- CISA stands for Certified Information Systems Auditor and is a globally recognized qualification for IT auditing, governance, risk management, and information security.
Who benefits most from CISA certification?
- It is especially suited to professionals in IT auditing, IT security, risk management, compliance, and IT governance.
What experience and qualifications are expected for CISA?
- Several years of relevant professional experience in IT auditing or related fields are required. Certain academic qualifications may be credited.
What international standing does CISA certification carry?
- CISA is recognized as a global audit standard and is valued by organizations, government agencies, and audit bodies worldwide.
How do you maintain CISA certification?
- The certification remains valid through regular continuing education and annual proof of Continuing Professional Education (CPE) credits.
What professional paths does CISA enable?
- CISA qualifies professionals for roles such as IT auditor, IT risk manager, security manager, compliance manager, or IT consultant.
Do you need deep technical IT knowledge for CISA?
- Not necessarily. The focus is on processes, controls, and governance rather than on deep technical implementation.
What value does CISA bring to organizations?
- Organizations with CISA-certified professionals gain greater IT transparency, reduce risks, and build on tested, reliable IT structures.
