IT Governance Frameworks for CPAs
IT governance is a core topic on the ISC section of the CPA exam. Understanding how organizations align IT strategy with business objectives and manage technology-related risks is essential for modern CPAs. Three frameworks dominate the exam: COBIT, COSO, and the NIST Cybersecurity Framework.
COBIT (Control Objectives for Information and Related Technologies)
Developed by ISACA, COBIT is a comprehensive IT governance and management framework. It provides principles, practices, and analytical tools to help organizations achieve their IT governance and management objectives. Key domains include:
- Evaluate, Direct, and Monitor (EDM): Governance processes that ensure IT delivers value while managing risk.
- Align, Plan, and Organize (APO): Setting IT strategy, architecture, and resource management.
- Build, Acquire, and Implement (BAI): Managing changes, system development, and solution delivery.
- Deliver, Service, and Support (DSS): Managing operations, service requests, and incident response.
- Monitor, Evaluate, and Assess (MEA): Measuring performance, compliance, and system of internal control.
COSO Framework and IT Controls
The COSO Internal Control Integrated Framework, while not IT-specific, directly applies to information technology controls. The five components map to IT:
- Control Environment: Management tone regarding IT security, IT organizational structure, and competency of IT personnel.
- Risk Assessment: Identifying and evaluating IT risks including cybersecurity threats, data integrity risks, and system availability concerns.
- Control Activities: IT general controls (access controls, change management, operations) and application controls (input, processing, output).
- Information and Communication: Systems that capture and distribute relevant information for decision-making and compliance.
- Monitoring Activities: Ongoing evaluation of IT controls, vulnerability assessments, and penetration testing.
NIST Cybersecurity Framework
The NIST framework organizes cybersecurity activities around five core functions:
| Function | Description | Key Activities |
|---|---|---|
| Identify | Understand cybersecurity risk to systems, people, assets, and data | Asset management, risk assessment, governance |
| Protect | Implement safeguards to ensure delivery of critical services | Access control, training, data security, encryption |
| Detect | Identify cybersecurity events in a timely manner | Monitoring, anomaly detection, continuous surveillance |
| Respond | Take action regarding a detected cybersecurity incident | Response planning, communications, analysis, mitigation |
| Recover | Restore capabilities impaired by a cybersecurity incident | Recovery planning, improvements, communications |
SOC Reports
System and Organization Controls reports are frequently tested on the ISC section. CPAs must understand the differences:
- SOC 1: Controls relevant to user entities' internal control over financial reporting (ICFR). Based on SSAE 18 / AT-C 320.
- SOC 2: Controls related to the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
- SOC 3: A general-use version of SOC 2 with less detail, suitable for public distribution.
- Type I vs. Type II: Type I evaluates design of controls at a point in time. Type II evaluates both design and operating effectiveness over a period (typically 6 to 12 months).
Build your IT governance knowledge with CPA flashcards and practice exams. Start free to access all ISC study materials.