IT Audit Fundamental Certificate — Lesson 2: Governance, Risk, Internal Controls, Processes, Systems, and Criteria

Learning Objectives

• Explain the roles, information, criteria, dependencies, and decision points governing IT governance and risk assessment.
• Implement or assess internal controls, business processes, and audit criteria using controlled evidence and acceptance criteria.
• Evaluate the condition where a control passes a basic check but business processes fails because internal controls data, criteria, or dependency assumptions differ and select a proportionate corrective response.

Detailed Topics

• IT governance applied to the course scenario, expected behavior, stakeholders, controls, risks, and evidence.
• risk assessment applied to the course scenario, expected behavior, stakeholders, controls, risks, and evidence.
• internal controls applied to the course scenario, expected behavior, stakeholders, controls, risks, and evidence.
• business processes applied to the course scenario, expected behavior, stakeholders, controls, risks, and evidence.
• audit criteria applied to the course scenario, expected behavior, stakeholders, controls, risks, and evidence.

Instructor Demonstration

The instructor traces a junior auditor reviewing a technology process while maintaining objectivity, evidence quality, clear findings, and constructive follow-up. The walkthrough connects frameworks, processes, tools, decisions, and evidence captured in the IT audit plan, test sheets, evidence file, and final audit summary. It also tests the exception where a control passes a basic check but business processes fails because internal controls data, criteria, or dependency assumptions differ.

Hands-On Exercise

Complete a controlled ISACA-aligned exercise covering Governance, Risk, Internal Controls, Processes, Systems, and Criteria and preserve the verified result in the IT audit plan, test sheets, evidence file, and final audit summary.

1. Confirm scope, roles, criteria, prerequisites, information sources, dependencies, and acceptance conditions.
2. Execute the governance, risk, audit, security, data, cloud, or technology workflow while recording decisions and evidence.
3. Test normal behavior, one boundary condition, and the stated exception using a controlled scenario.
4. Document findings, corrections, ownership, retest criteria, communication, and operational handover.

Scenario Analysis

• Identify which role, process, objective, control, data source, or decision most strongly influences IT governance.
• Compare two defensible responses and explain governance, risk, audit, security, privacy, operational, and business trade-offs.
• Determine how the IT audit plan, test sheets, evidence file, and final audit summary should be approved, retained, reviewed, retested, and updated.

Troubleshooting Guidance

Start where expected behavior first differs from the observed result. Check scope, criteria, ownership, data quality, process sequence, policy alignment, version compatibility, dependencies, status, and evidence separately. Treat “a control passes a basic check but business processes fails because internal controls data, criteria, or dependency assumptions differ” as a hypothesis until records, interviews, configurations, calculations, and retest outcomes confirm the cause.

Validation Checklist

• Required roles, processes, criteria, controls, information, approvals, and dependencies are present.
• The IT audit plan, test sheets, evidence file, and final audit summary connects each conclusion to objective, reviewable evidence.
• Normal processing, a boundary condition, dependency behavior, and the stated exception were tested.
• Corrections, ownership, retest criteria, documentation, communication, and operational handover are complete.

Lesson Outcome

Learners can apply Governance, Risk, Internal Controls, Processes, Systems, and Criteria, explain the resulting governance, risk, audit, security, data, or operational behavior, and defend the outcome through the IT audit plan, test sheets, evidence file, and final audit summary.