Information Systems Auditing Process · Topic 1 of 5
Audit Standards, Ethics and Types of Audits
ISACA IS audit standards and guidelines, the code of professional ethics, the audit charter, independence, and types of audits, assessments and reviews.
- 4 min
- Standards are mandatory; guidelines need justification to depart from.
- The charter sets authority and is approved at board or audit committee level.
- Report independence impairments; do not hide them.
What it is
ISACA sets IS audit and assurance standards that every CISA must follow, guidelines that explain how to apply them, and a Code of Professional Ethics for personal conduct. Together they make an audit trustworthy. The kind of engagement, from a compliance audit to a control self-assessment, then decides what the auditor tests and who relies on the result.
How it works
Standards, guidelines and the framework
ISACA publishes its standards inside ITAF, its professional practices framework for IS audit and assurance. The standards fall into three groups:
| Group | What it covers |
|---|---|
| General | The audit charter, independence, objectivity, due professional care, proficiency, assertions and criteria |
| Performance | How audit work is planned and performed: risk-based planning, supervision, evidence, using the work of other experts, and irregularities and illegal acts |
| Reporting | The report and follow-up activities |
Standards are mandatory. Guidelines are not mandatory, but the auditor must be able to justify departing from them.
The audit charter
The audit charter is approved by the board or audit committee. It sets the purpose, responsibility, authority and accountability of the audit function, including unrestricted access to records, people and systems. A charter is a long-term document; the annual plan changes, the charter rarely does.
An engagement letter does a similar job for one engagement, often for external audits.
Independence and objectivity
- Organizational independence: the audit function reports to a level that lets it work freely, usually the audit committee.
- Professional independence: the auditor has no personal stake in the area. An auditor who designed or ran a system should not audit it soon afterwards.
If independence is impaired, the auditor discloses it to the appropriate parties. Giving advice on control design during a project is allowed, as long as the auditor does not make management decisions or own the control.
The ISACA Code of Professional Ethics
Members and certification holders commit to: support appropriate standards and controls; perform duties with objectivity, due diligence and professional care; serve stakeholders lawfully; maintain privacy and confidentiality of information; maintain competency; inform appropriate parties of the results of work, revealing all significant facts known; and support the professional education of stakeholders.
Types of audits, assessments and reviews
| Type | Focus |
|---|---|
| Compliance audit | Whether controls and practices meet laws, regulations or policies |
| Financial audit | Accuracy and fairness of financial statements |
| Operational audit | Efficiency and effectiveness of operations and controls |
| Integrated audit | Financial, operational and IS controls examined together |
| IS audit | Controls over information systems and IT processes |
| Specialized audit | A defined area such as third-party services or fraud |
| Forensic audit | Finding, preserving and presenting evidence of fraud or crime |
An assessment or review is often narrower or gives less assurance than a full audit. A control self-assessment (CSA) has business staff evaluate their own controls, often in facilitated workshops; it raises control awareness but does not replace the independent audit.
How the exam asks about this
- "The auditor helped design the new system. What should happen?" Disclose the independence issue; another auditor should perform the audit.
- "Which document grants audit its authority?" The audit charter, approved by the audit committee or board.
- "What is the main benefit of CSA?" Line management takes ownership of controls and control awareness improves.
What to remember for the exam
- Standards are mandatory; guidelines need justification to depart from.
- The charter sets authority and is approved at board or audit committee level.
- Report independence impairments; do not hide them.
- Integrated audits combine financial, operational and IS controls.
- CSA supplements audit; it never replaces it.
An IS auditor who implements a control has stopped auditing. Recommend the control; management implements it.
Common mistakes
Treating guidelines as optional with no justification. Departures must be explained.
Thinking CSA removes the need for audit. It adds awareness; independent assurance still comes from audit.
Ignoring past involvement. Recent design or operation of a system impairs independence.
Check yourself
Who approves the audit charter?
The board or its audit committee.
What should an IS auditor do if independence is impaired?
Disclose the impairment to the appropriate parties before or during the engagement.
What is the main purpose of an integrated audit?
To assess financial, operational and IS controls together in one engagement.
Topic 1 of 5 in Information Systems Auditing Process
Test yourself on Information Systems Auditing Process
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.