ISA 4.0 Module 2 – Topic Wise

Module 2: IT General Controls (ITGC) Audit Simulation End-to-End Practical ITGC Audit Simulation on Pinnacle Finserv Limited (PFL) Course Overview & Scope: Module 2 is the flagship practical simulation of the ISA 4.0 curriculum. Candidates take on the role of lead Information Systems Auditors conducting a comprehensive ITGC review of Pinnacle Finserv Limited (PFL), a multi-branch financial services entity. Through authentic evidence packs, candidates evaluate IT governance, change management authorization, user access administration, privileged accounts, backup schedules, batch operations, physical/environmental controls, and disaster recovery preparedness. The quiz series reinforces audit evidence synthesis, finding formulation, risk rating, and writing professional ITGC audit opinions. Key Regulatory Frameworks & Standards Covered: ICAI Information Systems Audit Standards, COSO 2013, ISO/IEC 27001:2022, COBIT 2019 Core Model, RBI Cybersecurity Framework for Banks. Core Audit Competencies Tested in Quizzes:

• Auditing end-to-end Change Management (RFC initiation, CAB approval, UAT sign-off, emergency change audit).
• Performing User Access Reviews (UAR) and identifying terminated employee access and dormant superuser accounts.
• Testing Segregation of Duties (SoD) conflicts across IT administration vs business transaction roles.
• Evaluating computer operations, backup retention cycles, restoration test logs, and alternative site readiness.
• Synthesizing audit findings into a formal Risk-Rated Audit Deficiency Schedule and forming an overall ITGC Opinion.

Detailed Topic-Wise Active Quiz Index (Module 2)

Chapter / Section	Topic Quiz Title	Qs
Chapter 1: Case Background (PFL) & ITGC Scoping	IT General Controls	10
	IS Audit in phases	1
Chapter 2: ITGC Reference Guide & Standards	IT General Controls	10
	IT Application controls	6
	Scope and steps of IS Audit of application software	6
Chapter 3: Exercise 1 – ITGC Audit Planning & Risk Assessment	Setting up of Audit objectives	6
	Creation of Risk control Matrix	2
	Risk Assessment	31
Chapter 4: Exercise 2 – Change Management Controls Audit	Change Management	25
	Version Control	2
	Log Management	8
	Operations Helpdesk & User Assistance	12
Chapter 5: Exercise 3 – Logical Access Management Audit	Logical Access Controls	21
	Paths of Logical Access Controls	10
	Logical Access Attacks and Exposures	89
	Access Control Mechanisms	66
	Authentication Techniques	63
	Logical Access Controls – User Management	2
	Software Testing and Implementation – Segregation of Duties	1
Chapter 6: Exercise 4 – Computer Operations & BCP Audit	Information Systems Operations	2
	Software Operations & Management	1
	Software Testing	5
	Business Continuity Management	16
	Objectives of BCP and BCM	10
Chapter 7: Exercise 5 – InfoSec & Incident Management Audit	Network Security Controls	17
	Introduction to Protection of Information Assets	22
	Using work of another auditor and expert	4
	Framework and best practices of IS Audit	4
Chapter 8: Exercise 6 – Synthesis, Remediation & ITGC Opinion	IT General Controls	10
	Evaluation of strength and weaknesses: judging by materiality	3
	Audit report structure and content	15
	Audit Deliverables & Communicating Audit Results	3
	Follow up review	5
	TOTAL ACTIVE QUESTIONS IN MODULE 2:	488