Auditing Identity and Access Management

5.0 CPEInformation Technology

Strengthen your audit expertise with a deep dive into Identity and Access Management (IAM). Learn how to evaluate access controls, identify risks, and assess IAM processes to ensure data security and compliance across modern systems.

VIDEO COURSE

Included with any paid Wisdify plan

Choose a plan to enroll and earn CPE.

View plans Already enrolled? Sign in to continue

About this course

Course 7 of 9 in our IT Audit Learning Path! Auditing Identity and Access Management (IAM) is a critical component of any cybersecurity and IT audit program. This course provides auditors and IT professionals with a comprehensive understanding of IAM concepts, frameworks, and control testing. You’ll explore the building blocks of IAM—identification, authentication, authorization, and accountability—and learn how they safeguard organizational systems from unauthorized access and data breaches.

Through practical examples and case studies, the course guides you in assessing IAM policies, reviewing access provisioning and termination processes, and auditing role-based and privileged access management. You’ll also gain insight into common IAM tools such as Active Directory, Okta, and cloud-based solutions like AWS IAM and Azure AD. By the end of this course, you’ll be equipped to evaluate the effectiveness of IAM controls, identify weaknesses, and translate technical findings into meaningful business insights.

This course covers topics that align with concepts addressed in Domain 5 of the Certified Information Systems Auditor (CISA®) exam framework. It is not affiliated with, endorsed by, or sponsored by ISACA®, nor does it guarantee exam preparation or certification outcomes.

What you’ll learn

Upon completion of this course, you will be able to:

To explain the core concepts of Identity and Access Management (IAM) and why they matter in IT audit and cyber risk.
To assess the effectiveness of least privilege and role-based access models in organizations.
To evaluate access provisioning and deprovisioning processes for control gaps.
To identify and understand common IAM and privileged access management (PAM) tools.
To conduct audit walkthroughs of IAM processes, including access requests, approvals, and terminations.
To recognize common findings and remediation strategies related to IAM audits.
To apply IAM auditing concepts through case studies and scenarios relevant to finance and business operations.

Your instructor

Michael Carroll, CPA, CISA, CISM

Course content

6 lessons · 31 steps · 2h 28m of video

01LESSON 1Introduction to Identity and Access Management (IAM)6 items

02LESSON 2Principle of Least Privilege & Role-Based Access Control (RBAC)6 items

03LESSON 3User Access Lifecycle Management4 items

04LESSON 4IAM / PAM Tooling8 items

05LESSON 5Auditing IAM in Practice5 items

06LESSON 6Course Wrap-Up1 item

Locked

Final assessment

Course access is required to take this assessment.

30 questions70% to passUnlimited attempts

On course completion: 5.0 CPE and a certificate

Course details

CPE: 5.0
Field of study: Information Technology
Course level: Not specified
Delivery method: QAS™ Self Study
Prerequisites: Completion of prior courses in Wisdify’s <a href="https://wisdify.com/it-auditing-learning-path-cpe-courses/">IT Audit Learning Path</a> is recommended.
Advance preparation: Not specified
Course content: 6 lessons · 31 steps
Assessment: Final assessment · 30 questions · pass 70%
Completion deadline: 365 days from enrollment
Last updated: January 2026
Registration: A Wisdify account, eligible subscription, and course enrollment are required.