IICTI Certified Information Security Auditor

Holders demonstrate that they can apply and evaluate risk-based audit planning and universe management, iSMS certification and third-party conformity audits, control design and operating effectiveness testing and evidence integrity, data analytics and continuous auditing, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Information Security Auditor.

Who it is for: Professionals working, or preparing to work, in audit, risk & governance roles.

1. 01Risk-based audit planning and universe management8% of the exam

   • Design a risk-based information security audit plan that allocates assurance effort to the highest residual risks.
   • Scope: Audit universe definition, risk-based annual and multi-year planning, IIA Global Internal Audit Standards (2024), ISO 19011:2018, materiality and coverage of emerging technology risk.
2. 02ISMS certification and third-party conformity audits12% of the exam

   • Lead ISMS conformity audits and evaluate nonconformities against accreditation requirements.
   • Scope: ISO/IEC 27001:2022 and 27002:2022, ISO/IEC 27006-1 and 27007 audit requirements, Stage 1/Stage 2, surveillance and transition audits, nonconformity grading and certification decisions.
3. 03Control design and operating effectiveness testing9% of the exam

   • Evaluate whether security controls are suitably designed and operate effectively over the audit period.
   • Scope: Test of design vs operating effectiveness, attribute and statistical sampling, re-performance, walkthroughs, ITGCs, SOC 2 Type II and ISAE 3402/3000 testing approaches.
4. 04Evidence integrity, data analytics and continuous auditing10% of the exam

   • Design evidence collection and analytics procedures that produce reliable, reproducible audit conclusions.
   • Scope: Sufficiency, reliability and relevance of evidence, chain of custody, CAATs, population testing with SQL/Python, log and configuration analytics, continuous control monitoring.
5. 05Identity, access and privileged account audit8% of the exam

   • Evaluate identity and privileged access controls for completeness, effectiveness and SoD risk.
   • Scope: Joiner-mover-leaver testing, entitlement reviews, segregation of duties conflicts, PAM controls, service account and secret governance, federated identity and MFA coverage analysis.
6. 06Cloud, SaaS and DevSecOps assurance7% of the exam

   • Evaluate security assurance over cloud and CI/CD environments where controls are code-defined and ephemeral.
   • Scope: Shared responsibility, CSA CCM v4 and CAIQ, ISO/IEC 27017/27018, CSPM evidence, IaC and pipeline control testing, container and Kubernetes configuration review, cloud audit logging.
7. 07Third-party and supply chain security audit8% of the exam

   • Evaluate third-party assurance evidence and determine the residual supply chain risk to the organization.
   • Scope: Vendor risk tiering, right-to-audit clauses, reliance on SOC reports and certifications, complementary user entity controls, SBOM and software supply chain assurance, fourth-party risk.
8. 08Regulatory and multi-framework compliance audit5% of the exam

   • Design integrated audit programmes that provide assurance across overlapping regulatory frameworks.
   • Scope: NIS2, DORA, GDPR Article 32, PCI DSS v4.0, NIST CSF 2.0, ISO/IEC 42001 for AI systems, control mapping and unified compliance frameworks, regulatory examination readiness.
9. 09Incident response, resilience and BCM audit7% of the exam

   • Evaluate the readiness and proven effectiveness of incident response and recovery capabilities.
   • Scope: Auditing IR plans and playbooks, ISO/IEC 27035, ISO 22301 and DORA ICT resilience testing, backup and recovery test evidence, post-incident review quality and lessons-learned tracking.
10. 10Technical security testing oversight for auditors8% of the exam

    • Evaluate technical testing results and determine whether they provide sufficient assurance for audit conclusions.
    • Scope: Interpreting vulnerability scans, penetration test and red team reports, scope and rules-of-engagement adequacy, configuration benchmark (CIS) compliance, remediation validation.
11. 11Audit findings, root cause and reporting to governance bodies8% of the exam

    • Lead the formulation and communication of audit findings that drive accountable remediation at board level.
    • Scope: Condition-criteria-cause-effect structure, root cause analysis, risk rating, management action plans, follow-up and closure validation, reporting to audit committees and boards.
12. 12Audit ethics, independence and quality assurance10% of the exam

    • Lead an audit function that maintains independence, quality and defensibility under external review.
    • Scope: Independence and objectivity threats, professional scepticism, ISACA ITAF, auditor competence (ISO/IEC 27006), working paper review, quality assurance and improvement programmes.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner