Study guide
10.2 Testing Methodologies for Accounting, Finance, IT, Operations, and Cybersecurity
CIA Part 2 Study Guide Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CIA Part 2 Exam Orientation
1.1 Current CIA Part 2 Exam Facts 1.2 Eligibility, Fees, and Pearson VUE Scheduling 1.3 Scoring, Results Timing, and the 2025 Syllabus Map
2 Chapter 2: Engagement Objectives and Scope
2.1 Topical Requirements in Objectives and Scope 2.2 Elements Used to Build Engagement Objectives 2.3 Scope Limitations, Stakeholder Requests, and Scope Changes
3 Chapter 3: Evaluation Criteria and Planning Context
3.1 Selecting and Testing Evaluation Criteria 3.2 Applying Topical Requirements When Planning 3.3 Strategy, Risk Management, and Performance of the Activity Under Review
4 Chapter 4: Technology, Continuity, and Finance in Planning
4.1 Cybersecurity, IT General Controls, Privacy, and Data Security 4.2 Business Continuity, Disaster Recovery, and Resilience 4.3 Finance and Accounting Concepts for the Activity Under Review
5 Chapter 5: Business Process and System Risks in Planning
5.1 Asset, Supply Chain, Inventory, Payables, Procurement, and Compliance Processes 5.2 Third-Party Process Risks 5.3 CRM, ERP, and GRC System Risks
6 Chapter 6: Engagement Approach and Project Management
6.1 Agile, Traditional, Integrated, and Remote Approaches 6.2 Project Management While Planning and Conducting Engagements
7 Chapter 7: Engagement Risk Assessment
7.1 Topical Requirements and Pervasive Financial, Operational, IT, Cyber, and Regulatory Risks 7.2 Emerging Risks and the Impact of Change 7.3 Methods to Evaluate and Prioritize Risks and Controls
8 Chapter 8: Structure, Environment, and Culture
8.1 Centralized vs Decentralized, Flat vs Traditional, In-Person vs Remote 8.2 Culture, Group Behavior, and Tone at the Top
9 Chapter 9: Control Design, Effectiveness, and Efficiency Procedures
9.1 Procedures to Evaluate Control Design 9.2 Procedures to Test Operating Effectiveness 9.3 Procedures to Test Control Efficiency
10 Chapter 10: Work Programs, Testing Methodologies, and Resources
10.1 Evaluating Adequacy of the Engagement Work Program 10.2 Testing Methodologies for Accounting, Finance, IT, Operations, and Cybersecurity 10.3 Financial, Human, and Technological Resources and Limitation Implications
11 Chapter 11: Information Sources and Preliminary Survey
11.1 Interviews, Observations, and Walk-Throughs 11.2 Data Analysis as an Information Source 11.3 Policies, Checklists, Risk-and-Control Questionnaires, and Self-Assessments
12 Chapter 12: Evidence Relevance, Sufficiency, and Reliability
12.1 Criteria for Evidence Quality 12.2 Independence, Corroboration, and the Control Environment 12.3 Evidence an Informed, Competent Person Could Rely On
13 Chapter 13: Technology Options for Findings and Conclusions
13.1 Artificial Intelligence, Machine Learning, and Robotic Process Automation 13.2 Continuous Monitoring, Dashboards, and Embedded Audit Modules
14 Chapter 14: Process Mapping and Data Analytics
14.1 Workflow Segments, Process Maps, Walk-Throughs, and RACI 14.2 Structured vs Unstructured Data and the Analytics Process 14.3 Diagnostic, Prescriptive, Predictive, Anomaly, and Text Analysis
15 Chapter 15: Analytical Review and Finding Evaluation
15.1 Ratios, Variances, Trends, and Benchmarking 15.2 Selecting Analytical Techniques for Engagement Objectives 15.3 Comparing Existing Conditions to Evaluation Criteria 15.4 Root Causes, Effects, and Significance of Findings
16 Chapter 16: Workpapers and Engagement Conclusions
16.1 Organizing Complete Workpapers with Sufficient Evidence 16.2 Linking Workpapers to Results; Retention, Regulation, and Policy 16.3 Aggregating Findings and Concluding on Governance, Risk, and Control
17 Chapter 17: Engagement Supervision
17.1 Supervision Throughout Planning and Fieldwork 17.2 Coordinating Assignments and Reviewing Workpapers and Conclusions 17.3 Evaluating Auditors' Performance
18 Chapter 18: Communication During the Engagement
18.1 Formal and Informal Communication Across Planning, Fieldwork, and Reporting 18.2 Situations That Require Escalation 18.3 Selecting Appropriate Stakeholders for Engagement Communication
19 Chapter 19: Final Review and Test Day
19.1 2025 vs 2019 Traps and Part 2 vs Part 3 Boundaries 19.2 Pacing, Test-Center Rules, and Official Results
10.2 Testing Methodologies for Accounting, Finance, IT, Operations, and Cybersecurity
Key Takeaways Explain This Topic AI
CIA Part 2 A6e tests matching methodology to domain: reconciliations, cutoff, and vouching or tracing for accounting; analytics for finance; configuration, ITGCs, and access tests for IT; observation and reperformance for operations; log review, identity evidence, and vulnerability-management evidence for cybersecurity.
Choose the method that can answer the objective; a vulnerability scan does not prove cutoff, and a mid-year observation does not prove period-end quantity.
Integrated engagements combine methods in one work program rather than forcing a single method across unlike risks.
After you pick a method family, the work program still must state nature, timing, extent, tools, and planned evidence.
Part 2 expects identification of an appropriate method, not a specialist textbook on accounting, ERP administration, or exploit development.
Last updated: August 2026
CIA Part 2 objective A6e asks you to identify testing methodologies for an engagement that includes accounting, finance, IT systems, business operations, or cybersecurity. The skill is matching. You are not sitting a second information-systems, finance, or pentest exam. Choose a method family that can produce relevant, sufficient, reliable evidence for that domain's objective, then record nature, timing, and extent on the work program from Chapter 10.1.
Quick Answer: Match the method to the domain: reconciliations, cutoff tests, and vouching or tracing for accounting; analytics, ratios, and variance analysis for finance; configuration review, IT general controls (ITGCs), and access testing for IT; observation and reperformance for operations; log review, identity evidence, and vulnerability-management evidence for cybersecurity. Integrated engagements combine those families in one work program. Do not use a pentest to answer a cutoff question, and do not use a ratio to prove a firewall rule.
Match Method to Domain, Then Set Extent
A methodology is the type of work you will do. Extent is how much, where, and for which period. CIA stems fail candidates who pick a fashionable method that cannot answer the objective. Vulnerability scans do not prove revenue cutoff. A warehouse observation in July does not prove 31 December quantity. A ratio spike is a pointer, not by itself a completeness conclusion.
Domain Typical objectives Methodologies that usually fit What they are not
Accounting Existence, completeness, cutoff, accuracy, classification of recorded transactions and balances Reconciliations (GL to subledger, bank, inventory); cutoff tests around period-end; vouching recorded items to source documents; tracing source documents into the records; recalculation A strategy workshop or a culture survey
Finance Reasonableness of results, budget discipline, performance reporting, working-capital movements Analytics: ratios, trends, variance to budget or forecast, reasonableness tests, peer or internal benchmarks Recalculating every invoice when analytics already isolate the residual risk
IT systems ITGCs, application configuration, access, change management, interfaces Configuration reviews against approved baselines; ITGC tests of access, change, and computer operations; user-access and privileged-access tests; interface reconciliations Rewriting code or acting as system administrator
Business operations Process actually runs as designed; physical safeguards; cycle time at the control Observation of the control in operation; reperformance of the control; physical inspection; limited timing studies when efficiency is in scope A full industrial-engineering restudy of the plant
Cybersecurity Identity, logging and monitoring, vulnerability and patch handling, selected configuration hardening Log review and monitoring evidence; identity lifecycle and privileged-access evidence; vulnerability-scan and patch-exception evidence; sampling of incident tickets Writing exploits or certifying the entire information-security management system
Keep Chapter 9 in its lane. That chapter taught which procedure family (design, operating effectiveness, efficiency) you need. This chapter teaches which domain method you reach for once that family is chosen. Example: operating effectiveness of a three-way match plus accounting vouching of matched invoices can sit in the same task. Operating effectiveness of a privileged-access review plus cyber identity evidence can sit in another.
Accounting: Reconcile, Cut Off, Vouch
Accounting methodologies stay close to the records. Reconciliations test whether two independently maintained records tell the same story—subledger to general ledger, bank to cash book, inventory subledger to the GL control account. The auditor either reperforms the reconciliation or tests management's reconciliation for completeness of reconciling items and timely clearance.
Cutoff tests whether transactions near a period boundary landed in the correct period. Typical evidence is shipping logs, receiving reports, invoice dates, and system posting dates for a window before and after period-end. Cutoff is a timing methodology; it is not a random sample from mid-year.
Vouching starts with the recorded amount and inspects source documents (recorded to source), which primarily supports existence or occurrence. Tracing starts with the source and follows it into the records (source to recorded), which primarily supports completeness. CIA items still punish mixing those directions. Recalculation and independent confirmation appear when the objective needs mathematical accuracy or third-party corroboration. You do not need a full financial-statement audit program; you need the method that matches the accounting objective on the engagement.
Finance: Let Analytics Do the Heavy Sorting
Finance testing on Part 2 is usually analytical : ratios, trends, budget-versus-actual, flash-versus-forecast, and reasonableness models (for example, interest expense versus average debt). Analytics are strongest when they isolate where detailed testing should go, and when the objective is about the reasonableness of reported performance rather than the existence of a single invoice.
Set the expectation in the work program: which metric, which comparator, what threshold sends you to detail, and what evidence you will pull when the analytic breaks. An analytic with no threshold is a sightseeing tour. Detailed vouching of every journal when a clean variance analysis already explained the movement wastes resources (Chapter 10.3) and is the wrong methodology for a finance reasonableness objective.
IT: Configuration, ITGCs, and Access
IT methodologies ask whether the system environment can be relied on. ITGCs typically cover access, change management, and computer operations. Configuration reviews compare actual settings—approval workflows, segregation flags, password parameters, interface job schedules—to an approved baseline. Access tests examine joiner-mover-leaver evidence, recertifications, and privileged IDs.
You are evaluating controls and evidence, not administering the system. Do not volunteer to reset a production role. For CIA, it is enough to know that an ERP accounts-payable engagement with an automated three-way match usually must include ITGC, access, or configuration work on that match; ignoring the system that enforces the control is an inadequate methodology mix, not a time-saver.
Operations: Watch It and Do It Again
Operations respond to observation (watch the control operate) and reperformance (the auditor performs the control independently and compares results). Physical inspection of assets, seals, or restricted areas belongs here when existence or safeguarding is in scope. Observation is time-specific: seeing the count on the count day is not the same as reading last quarter's count memo. Reperformance is powerful for checklists, reconciliations, and calculations that a competent auditor can execute without becoming the process owner.
If efficiency is an objective, operations methods may include limited timing or exception-rate work. That is still not a consulting mandate to redesign the line. Chapter 9's efficiency procedures tell you what efficient means; this chapter tells you that you will usually observe or reperform the operational control rather than only read a procedure manual.
Cybersecurity: Logs, Identity, Vulnerability Evidence
Cyber on Part 2 is evidence about management's control, not a capture-the-flag contest. Log review inspects whether relevant events are collected, retained, reviewed, and escalated. Identity evidence covers provisioning, multi-factor or equivalent authentication, privileged-access vaulting, and recertification. Vulnerability evidence includes scan results, exception handling, and patch service levels—evaluated as a process, not re-run as an amateur pentest.
Topical Requirements may raise the floor when cybersecurity is in scope (Chapters 4 and 7). They do not turn every CIA candidate into a red-team lead. If the objective is that privileged access to the payment file is restricted, identity and log evidence fit. If the objective claims every web application is free of injection flaws, you likely need a specialist (Chapter 10.3), and the work program should say so rather than pretending a staff walk-through of the login page is enough.
Integrated Engagements Combine Methods on Purpose
Real CIA stems rarely stay in one domain. Payroll accuracy plus the HR/payroll application plus privileged access is one engagement, one work program, several methodologies:
Accounting: reconcile payroll subledger to GL; recalculate a sample of gross-to-net; cutoff for period-end accruals.
Finance: analytics on overtime, headcount versus salary cost, budget variance.
IT: ITGCs and configuration of pay-cycle jobs and role design.
Operations: observe time-entry approval on a shift; reperform a sample of supervisor approvals.
Cyber: privileged-access listings, joiner-leaver logs, and selected authentication evidence for accounts that can change bank details.
The failure mode is method monopoly: using only interviews, only analytics, or only a vendor pentest report for every objective. Integrated work is still one approved program (Chapter 10.1) with tasks tagged to the right method. Nature, timing, and extent remain mandatory inside each task. Choosing cyber log review without a period, system, and population is not a methodology; it is a slogan.
The illustrative hour mix in the chart below is a teaching example for one integrated procure-to-pay job, not an IIA official weighting. Use it to remember that accounting, IT, and cyber often share the stage when the process runs in an ERP.