IS Audit, is a 45-hour, fully online foundation-level certification for government audit officers, co-developed by IITM Pravartak and the Comptroller and Auditor General (CAG) of India, and hosted on the SWAYAM Plus LMS. Building on foundational IT systems audit knowledge, the programme teaches control-audit methodology — how to plan, test, evidence, and report on IS controls, distinct from IT system operation — across 10 modules spanning IS audit foundations, regulations as audit criteria, control frameworks and types of controls, ITGC audit, application controls audit, IS audit testing/sampling/evidence, IT project audit, CAATs for IS control testing, IS audit reporting/CCCER drafting, and an integrated capstone simulation. The programme is aligned with CISA Foundation domains: IS Audit Process; Governance & Management of IT; IS Operations (awareness); Protection of Information Assets (awareness).

Intended audience

Public Auditors under CAG and anyone interested in public Audit domain

Prerequisites

Public Audit (Foundation) is a mandatory course for all CADS learners. Successful completion of Public Audit (Foundation) is a prerequisite for enrolment in the IS Audit domain, as it is for all other CADS technical domains. Learners are advised to complete Public Audit (Foundation) first before proceeding to this domain.
All of: Public Audit - Certification on Audit of Digital Systems (CADS) Foundational level

Assessment & certification

Assessment fee: Included — no extra fee
Assessment mode: Center based
Assessment type: MCQ
Assessment provider: IITM Pravartak Technologies Foundation
Certificate provider: The Passing percentage is 50% of the total marks

NCrF level: 6 (NCrF credit-eligible)

Syllabus

Week 1: Module 1: IS Audit Foundations & Control-Audit Mindset
IS Audit vs IT Systems Audit vs Financial Audit — Setting the Boundary IS Audit Engagement Lifecycle & Scoping CAG's IS Audit Regulatory & Methodological Framework
Week 2: Module 2: Regulations as IS Audit Criteria: Applied Use
Indian IT Regulations as Audit Criteria, Applied View CAG-Specific Compliance Frameworks for IS Audit Regulation-to-Control Mapping Methodology
Week 3: Module 3: IS Control Frameworks & Types of Controls
Framework Application to IS Audit (not Framework Introduction) IS Governance Mechanism Types of Controls; Classification & Application Control Design Adequacy vs Operating Effectiveness Control Maturity & Risk-Based Selection of Key Controls
Week 4: Module 4: ITGC Audit - Detailed Methodology
Access Management Controls: Audit Methodology Change Management Controls; Audit Methodology Backup, Recovery & Operational Controls — Audit Methodology Audit Trails, Log Management & Evidence
Week 5: Module 5: Application Controls Audit; Methodology & Applied Testing
Application Controls: Framework & Types Automated Controls, Business Rules & Testing Approach Application Control Audit, Government System Walkthroughs
Week 6: Module 6: IS Audit Methodology: Testing, Sampling & Evidence
IS Audit Testing Approaches & Sampling IS Audit Evidence & Working Papers Test Design for Common IS Audit Areas
Week 7: Module 7: IS Audit of IT Projects
IT Project Audit Methodology: Audit Lens, Not Project Lifecycle Procurement, Contract & Vendor Audit: IS-Audit Lens IT Asset Lifecycle Audit & E-Waste Disposal
Week 8: Module 8: CAATs Applied to IS Control Testing
CAATs for IS Audit: Scope & Approach CAAT Patterns for ITGC Testing CAAT Patterns for Application Controls & Audit Trail Analysis
Week 9: Module 9: IS Audit Reporting & CCCER Drafting
IS Audit Report Structure & Risk Rating CCCER Element Walk-through for IS Controls Observations
Week 10: Module 10: Capstone, Integrated IS Audit Simulation & Certification Readiness
Capstone Briefing & Integrated Audit Planning CADS Programme Architecture & CISA Alignment MCQ Examination Strategy & Self-Assessment Practice