Home / CPA Course / ISC

Testing security controls

ISC Chapter 14 · Area II · Blueprint II.B.3

Controls on paper protect nothing. This chapter puts on the auditor's hat. Priya and Sam test Brightwater's and PayLoom's security: how staff learn to be careful, how the testing techniques work, how a walkthrough of IT security, HR and training procedures shows what really happens, how the common criteria of the Trust Services Criteria frame security testing, how to tell a design deficiency from an operating deviation, and finally how to write findings that a reader can act on. The exam's analysis tasks for security live here, so the lessons lean on cases with real dates, samples and exceptions.

In this chapter

1. Understanding the security awareness program
2. How security controls are tested
3. Walkthroughs of IT security, HR and training procedures
4. Security in the Trust Services Criteria
5. Design deficiencies and operating deviations in security controls
6. Writing findings for a security assessment report

This chapter has 6 lessons, 50 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

• Security awareness programs
• security assessment reports
• walkthroughs
• control deficiencies under the Trust Services Criteria

Chapter 13: Controls, authentication and authorization · Chapter 15: Confidentiality and privacy