SAME WEIGHTAGE AS BEFORE

WEIGHTAGE CHANGE:  +1%

WEIGHTAGE CHANGE : -6%

WEIGHTAGE CHANGE: +3%

WEIGHTAGE CHANGE:  +2%

1.2   Knowledge of the risk assessment concepts and tools and techniques used in planning, examination, reporting and follow-up

1.3   Knowledge of fundamental business processes (e.g., purchasing, payroll, accounts payable, accounts receivable) and the role of IS in these processes

1.4   Knowledge of the control principles related to controls in information systems

1.5   Knowledge of risk-based audit planning and audit project management techniques, including follow-up

1.6   Knowledge of the applicable laws and regulations that affect the scope, evidence collection and preservation, and frequency of audits

1.7   Knowledge of the evidence collection techniques (e.g., observation, inquiry, inspection, interview, data analysis, forensic investigation techniques, computer-assisted audit techniques [CAATs]) used to gather, protect and preserve audit evidence

1.8   Knowledge of different sampling methodologies and other substantive/data analytical procedures

1.9   Knowledge of reporting and communication techniques (e.g., facilitation, negotiation, conflict resolution, audit report structure, issue writing, management summary, result verification)

1.10        Knowledge of audit quality assurance (QA) systems and frameworks

1.11        Knowledge of various types of audits (e.g., internal, external, financial) and methods for assessing and placing reliance on the work of other auditors or control entities

A. Planning

1.     IS Audit Standards, Guidelines, and Codes of Ethics

2.     Business Processes

3.     Types of Controls

4.     Risk-Based Audit Planning

5.     Types of Audits and Assessments

   B. Execution

1.     Audit Project Management

2.     Sampling Methodology

3.     Audit Evidence Collection Techniques

4.     Data Analytics

5.     Reporting and Communication Techniques

2.3Knowledge of the organizational structure, roles and responsibilities related to IT, including segregation of duties (SoD)

2.4 Knowledge of the relevant laws, regulations and industry standards affecting the organization

2.5 Knowledge of the organization’s technology direction and IT architecture and their implications for setting long-term strategic directions

2.6 Knowledge of the processes for the development, implementation and maintenance of IT strategy, policies, standards and procedures

2.7 Knowledge of the use of capability and maturity models

2.8 Knowledge of process optimization techniques

2.9 Knowledge of IT resource investment and allocation practices, including prioritization criteria (e.g., portfolio management, value management, personnel management)

2.10  Knowledge of IT supplier selection, contract management, relationship management and performance monitoring processes, including third-party outsourcing relationships

2.11 Knowledge of enterprise risk management (ERM)

2.12  Knowledge of the practices for monitoring and reporting of controls performance (e.g., continuous monitoring, quality assurance [QA])

2.13 Knowledge of quality management and quality assurance (QA) systems

2.14 Knowledge of the practices for monitoring and reporting of IT performance (e.g., balanced scorecard [BSC], key performance indicators [KPIs])

2.15 Knowledge of business impact analysis (BIA)

2.16 Knowledge of the standards and procedures for the development, maintenance and testing of the business continuity plan (BCP)

2.17 Knowledge of the procedures used to invoke and execute the business continuity plan (BCP) and return to normal operations

A. IT Governance

1.     IT Governance and IT Strategy

2.     IT-Related Frameworks

3.     IT Standards, Policies, and Procedures

4.     Organizational Structure

5.     Enterprise Architecture

6.     Enterprise Risk Management

7.     Maturity Models

8.     Laws, Regulations, and Industry Standards affecting the Organization

   B. IT Management

1.     IT Resource Management

2.     IT Service Provider Acquisition and Management

3.     IT Performance Monitoring and Reporting

4.     Quality Assurance and Quality Management of IT

3.2 Knowledge of IT acquisition and vendor management practices (e.g., evaluation and selection process, contract management, vendor risk and relationship management, escrow, software licensing), including third-party outsourcing relationships, IT suppliers and service providers.

3.3 Knowledge of project governance mechanisms (e.g., steering committee, project oversight board, project management office)

3.4 Knowledge of project management control frameworks, practices and tools

3.5 Knowledge of the risk management practices applied to projects

3.6 Knowledge of requirements analysis and management practices (e.g., requirements verification, traceability, gap analysis, vulnerability management, security requirements)

3.7 Knowledge of the enterprise architecture (EA) related to data, applications and technology (e.g., web-based applications, web services, n-tier applications, cloud services, virtualization)

3.8 Knowledge of system development methodologies and tools, including their strengths and weaknesses (e.g., agile development practices, prototyping, rapid application development [RAD], object-oriented design techniques, secure coding practices, system version control)

3.9 Knowledge of the control objectives and techniques that ensure the completeness, accuracy, validity and authorization of transactions and data

3.10 Knowledge of the testing methodologies and practices related to the information system development life cycle (SDLC)

3.11 Knowledge of the configuration and release management relating to the development of information systems

3.12 Knowledge of system migration and infrastructure deployment practices and data conversion tools, techniques and procedures.

3.13 Knowledge of project success criteria and project risk

3.14 Knowledge of post-implementation review objectives and practices (e.g., project closure, control implementation, benefits realization, performance measurement)

A. Information Systems Acquisition and Development

1.     Project Governance and Management

2.     Business Case and Feasibility Analysis

3.     System Development Methodologies

4.     Control Identification and Design

   B. Information Systems Implementation

1.     Testing Methodologies

2.     Configuration and Release Management

3.     System Migration, Infrastructure Deployment, and Data Conversion

4.     Post-implementation Review

4.2 Conduct periodic reviews of information systems to determine whether they continue to meet the organization’s objectives within the enterprise architecture (EA).

4.3 Evaluate IT operations (e.g., job scheduling, configuration management, capacity and performance management) to determine whether they are controlled effectively and continue to support the organization’s objectives.

4.4 Evaluate IT maintenance (patches, upgrades) to determine whether they are controlled effectively and continue to support the organization’s objectives.

4.5 Evaluate database management practices to determine the integrity and optimization of databases.

4.6 Evaluate data quality and life cycle management to determine whether they continue to meet strategic objectives.

4.7 Evaluate problem and incident management practices to determine whether problems and incidents are prevented, detected, analyzed, reported and resolved in a timely manner to support the organization´s objectives.

4.8 Evaluate change and release management practices to determine whether changes made to systems and applications are adequately controlled and documented.

4.9 Evaluate end-user computing to determine whether the processes are effectively controlled and support the organization’s objectives.

4.10 Evaluate IT continuity and resilience (backups/restores, disaster recovery plan [DRP]) to determine whether they are controlled effectively and continue to support the organization’s objectives.

A. Information Systems Operations

1.     Common Technology Components

2.     IT Asset Management

3.     Job Scheduling and Production Process Automation

4.     System Interfaces

5.     End-User Computing

6.     Data Governance

7.     Systems Performance Management

8.     Problem and Incident Management

9.     Change, Configuration, Release, and Patch Management

10. IT Service Level Management

11. Database Management

   B. Business Resilience

1.     Business Impact Analysis (BIA)

2.     System Resiliency

3.     Data Backup, Storage, and Restoration

4.     Business Continuity Plan (BCP)

5.     Disaster Recovery Plans (DRP)

5.1 Knowledge of the generally accepted practices and applicable external requirements (e.g., laws, regulations) related to the protection of information assets

5.2 Knowledge of privacy principles

5.3 Knowledge of the techniques for the design, implementation, maintenance, monitoring and reporting of security controls

5.4 Knowledge of the physical and environmental controls and supporting practices related to the protection of information assets

5.5 Knowledge of the physical access controls for the identification, authentication and restriction of users to authorized facilities and hardware

5.6 Knowledge of the logical access controls for the identification, authentication and restriction of users to authorized functions and data

5.7 Knowledge of the security controls related to hardware, system software (e.g., applications, operating systems) and database management systems.

5.8 Knowledge of the risk and controls associated with virtualization of systems

5.9 Knowledge of the risk and controls associated with the use of mobile and wireless devices, including personally owned devices (bring your own device [BYOD])

5.10 Knowledge of voice communications security (e.g., PBX, Voice-over Internet Protocol [VoIP])

5.11 Knowledge of network and Internet security devices, protocols and techniques

5.12 Knowledge of the configuration, implementation, operation and maintenance of network security controls

5.13 Knowledge of encryption-related techniques and their uses

5.14 Knowledge of public key infrastructure (PKI) components and digital signature techniques

5.15 Knowledge of the risk and controls associated with peer-to-peer computing, instant messaging, and web-based technologies (e.g., social networking, message boards, blogs, cloud computing)

5.16 Knowledge of the data classification standards related to the protection of information assets

5.17 Knowledge of the processes and procedures used to store, retrieve, transport and dispose of confidential information assets

5.18 Knowledge of the risk and controls associated with data leakage

5.19 Knowledge of the security risk and controls related to end-user computing

5.20 Knowledge of methods for implementing a security awareness program

5.21 Knowledge of information system attack methods and techniques

5.22 Knowledge of prevention and detection tools and control techniques

5.23 Knowledge of security testing techniques (e.g., penetration testing, vulnerability scanning)

5.24 Knowledge of the processes related to monitoring and responding to security incidents (e.g., escalation procedures, emergency incident response team)

5.25 Knowledge of the processes followed in forensics investigation and procedures in collection and preservation of the data and evidence (i.e., chain of custody).

5.26 Knowledge of the fraud risk factors related to the protection of information assets

A. Information Asset Security and Control

1.     Information Asset Security Frameworks, Standards, and Guidelines

2.     Privacy Principles

3.     Physical Access and Environmental Controls

4.     Identity and Access Management

5.     Network and End-Point Security

6.     Data Classification

7.     Data Encryption and Encryption-Related Techniques

8.     Public Key Infrastructure (PKI)

9.     Web-Based Communication Techniques

10. Virtualized Environments

11. Mobile, Wireless, and Internet-of-Things (IoT) Devices

   B. Security Event Management

1.     Security Awareness Training and Programs

2.     Information System Attack Methods and Techniques

3.     Security Testing Tools and Techniques

4.     Security Monitoring Tools and Techniques

5.     Incident Response Management

6.     Evidence Collection and Forensics