This study investigated the major components of professional Information System (IS) auditor's domain knowledge underlying the Information System control review task. A conceptual model, consisting of knowledge by which expert and novice IS auditors review information system controls, was developed. Propositions were derived from the model and empirically tested. The research methodology used in this study included both observations of subjects' performing the review task using concurrent verbal protocols, and statistical analysis of subjects' responses. Results demonstrated that expert IS auditors have more and better organized schemata of knowledge. In addition, it was found that domain knowledge used by IS auditors in reviewing IS controls was based predominantly upon prototypic knowledge as opposed to system knowledge. This study provided implications for both the development of knowledge based systems, and training and education in information system auditing and control area.