Rule Atlas
GDPR: Risk-Based IS Audit Planning
Under GDPR (ISACA / NIST / SOC 2), risk-Based IS Audit Planning establishes the authoritative rules tested on the ISACA CISA. Develop a dynamic, risk-based annual IS audit plan from the ground up. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
Worked Example: Building a Risk-Based Plan for InnovateHealth
| Auditable Entity | Impact (1-5) | Likelihood (1-5) | Inherent Risk Score | Priority |
|---|---|---|---|---|
| EHR Database | 5 (Massive PHI breach) | 4 (Complex, high access) | 20 | High |
| Patient Portal | 4 (Patient data exposure) | 5 (Internet-facing threat) | 20 | High |
| 3rd-Party Billing | 4 (Revenue cycle impact) | 3 (Depends on vendor controls) | 12 | Medium |
| Network Infrastructure | 3 (Internal outage) | 2 (Historically strong controls) | 6 | Low |
During the annual audit planning at SecureTech Solutions, the audit committee is deciding how to allocate resources for the upcoming year. Given limited resources and several potential audit areas, risk-based audit planning PRIMARILY ensures that:
Worked Example: Building a Risk-Based Plan for InnovateHealth
Scenario: InnovateHealth, a healthcare technology provider, needs its annual IS audit plan. The IS audit team has limited hours and must focus on the most critical areas.
- Step 1: Identify Key Entities in the Audit Universe A partial list includes: Electronic Health Record (EHR) Database Internet-Facing Patient Portal Application Third-Party Medical Billing System Internal Network Infrastructure
- Step 2: Conduct a Risk Assessment The team scores each entity on a 1-5 scale for Impact and Likelihood to determine an Inherent Risk Score (Impact x Likelihood).
- | Auditable Entity | Impact (1-5) | Likelihood (1-5) | Inherent Risk Score | Priority | | :--- | :--- | :--- | :--- | :--- | | EHR Database | 5 (Massive PHI breach) | 4 (Complex, high access) | 20 | High | | Patient Portal | 4 (Patient data exposure) | 5 (Internet-facing threat) | 20 | High | | 3rd-Party Billing | 4 (Revenue cycle impact) | 3 (Depends on vendor controls) | 12 | Medium | | Network Infrastructure | 3 (Internal outage) | 2 (Historically strong controls) | 6 | Low |
- Step 3: Develop the Annual Audit Plan & Allocate Resources Based on the risk scores, the team drafts the plan: High-Risk (Score 15-25): The EHR Database and Patient Portal are prioritized for in-depth audits in the first half of the year. Resource Allocation: 200 audit hours each, staffed with senior auditors with cybersecurity skills. Medium-Risk (Score 8-14): The Third-Party Billing System is scheduled for a vendor risk management audit in Q3. Resource Allocation: 100 audit hours. Low-Risk (Score 1-7): The Network Infrastructure will receive a limited-scope review in Q4, focusing only on recent changes. Resource Allocation: 50 audit hours.
Common ISACA CISA Distractors on GDPR
- 1Use this framework to dissect audit planning questions on the CISA exam:
- 2Step 1: Identify the Phase. Is the question about creating the universe (identification), assessing risk (prioritization), developing the plan (scheduling), or executing the audit? The correct action depends entirely on the current phase.
- 3Step 2: Pinpoint the Core Principle. The answer will almost always hinge on risk. Look for the option that best aligns audit effort with business risk, strategic objectives, or regulatory requirements.
- 4Step 3: Eliminate Out-of-Sequence Options. If the question asks for the FIRST or NEXT step, immediately discard options that happen later in the process. You can't allocate resources (Step 3) before you've assessed risk (Step 2).
- 5To remember the key risk factors during an assessment, use the mnemonic CLIMATE:
Frequently Asked Questions: GDPR
What is the core rule under GDPR (Risk-Based IS Audit Planning)?
Under GDPR (ISACA / NIST / SOC 2), risk-Based IS Audit Planning establishes the authoritative rules tested on the ISACA CISA. Develop a dynamic, risk-based annual IS audit plan from the ground up. VoraPrep verifies every threshold, worked table, and practice question below against the current ISACA CISA blueprint.
How is GDPR tested on the ISACA CISA?
Use this framework to dissect audit planning questions on the CISA exam: Step 1: Identify the Phase. Is the question about creating the universe (identification), assessing risk (prioritization), developing the plan (scheduling), or executing the audit? The correct action depends entirely on the current phase.
Where can I practice ISACA CISA questions on Risk-Based IS Audit Planning?
Test yourself instantly with the free playable ISACA CISA question on this page, or launch VoraPrep's full ISACA CISA adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cisa.