ISA 4.0 Module 5 – Topic Wise

Module 5: IT Governance, Risk & Compliance (GRC) Audits Corporate Governance of IT, COBIT 2019, COSO ERM, IT Strategy Alignment & Regulatory Assurance Course Overview & Scope: IT Governance, Risk and Compliance (GRC) represents the strategic oversight layer that ensures technology investments deliver business value while optimizing risk and maintaining regulatory compliance. This course covers the Three Lines Model, corporate governance of IT (ISO/IEC 38500), COBIT 2019 core governance and management objectives, COSO Enterprise Risk Management (ERM), IT Strategic Planning, IT Steering and Strategy Committees, Enterprise Architecture (TOGAF), Risk Assessment methodologies, Risk Registers, Key Risk Indicators (KRIs), compliance management programs, and audit reporting. Key Regulatory Frameworks & Standards Covered: ISO/IEC 38500 (Corporate Governance of IT), COBIT 2019 Framework, COSO ERM (2017), Companies Act 2013 (Internal Financial Controls), RBI IT Governance Master Directions. Core Audit Competencies Tested in Quizzes:

• Auditing IT Strategy alignment with business objectives and reviewing IT Steering Committee minutes.
• Evaluating Enterprise Governance of IT (EGIT) using COBIT 2019 design factors and maturity models.
• Auditing the Enterprise IT Risk Management framework, risk appetite statements, and Risk Registers.
• Assessing IT policy lifecycle, exception approval processes, and regulatory compliance monitoring.
• Formulating high-impact GRC audit findings, conducting Root Cause Analysis (RCA), and presenting to Boards.

Detailed Topic-Wise Active Quiz Index (Module 5)

Chapter / Section	Topic Quiz Title	Qs
Chapter 1: GRC Fundamentals & The Three Pillars	Concepts of Governance and Management of	2
	Corporate Governance	8
	Corporate Governance and Regulatory Requirements	5
	Enterprise Governance of Information and Technology (EGIT)	12
	Implementing EGIT	3
	Systemic Approach to Implementing EGIT	21
	Governance Objectives	3
Chapter 2: GRC Frameworks & Standards	ISO 31000	2
	GRC Frameworks and Risk Management Practices – Enterprise Risk Management	8
	Risk Management in COBIT 2019	3
	Risk Management Process	10
	Risk Evaluation	2
	Risk Response-2	5
Chapter 3: IT Governance in Practice & Strategy Alignment	Components of the Governance System as per COBIT 2019	3
	Principles, Policies, Procedures	22
	Processes	5
	Organizational Structures	6
	IT Strategy Committee	3
	IT Steering Committee	9
Chapter 4: IT Risk Management in Practice	Concept of IT Risk	7
	IT Risk in the risk hierarchy	8
	Concepts of IS Audit – Risk Management	9
	Risk based auditing	14
	Governance and Management controls	3
	Creation of Risk control Matrix	2
Chapter 5: IT Compliance Management in Practice	Internal and external audit control framework	3
	Compliance Testing	19
	Substantive Testing	15
Chapter 6: The GRC Audit Lifecycle	IS Audit in phases	1
	Setting up of Audit objectives	6
	Request for proposal and submitting response	7
	IS Audit Charter	21
	Audit scope	11
Chapter 7: Practical Tools, Checklists & Templates	Creation of Risk control Matrix	2
	Objectives of IS Controls	12
	Principles of security (CIA)	7
	Understanding the auditee environment	10
Chapter 8: Audit Findings, Root Cause Analysis & Reporting	Evaluation of strength and weaknesses: judging by materiality	3
	Audit report structure and content	15
	Audit Deliverables & Communicating Audit Results	3
	Follow up review	5
Chapter 9: Emerging Trends in GRC	Aligning IT Strategy with Enterprise Strategy	4
	Value Optimization	3
	Resource Optimization	3
Chapter 10: Common Red Flags & Practical Tips	Risk Assessment	31
	Guidance on Risk assessment by ISACA	3
	Risk Management steps	3
Chapter 11: Case Studies & Practical Exercises	Risk assessment procedures and related activities	2
	IT General Controls	10
	IT Application controls	6
	Scope and steps of IS Audit of application software	6
	TOTAL ACTIVE QUESTIONS IN MODULE 5:	386