Information Systems Auditing Process · Topic 2 of 5
Risk-Based Audit Planning and Types of Controls
Risk-based IS audit planning, audit risk and its components, materiality, the audit universe, and preventive, detective and compensating controls.
- 3 min
- Includes a diagram
- Audit risk = inherent risk, control risk and detection risk.
- Only detection risk is under the auditor's direct control.
- The audit plan follows a risk assessment, not a fixed rotation.
What it is
Risk-based audit planning points limited audit resources at the areas where the business faces the most risk. Instead of auditing everything on a fixed cycle, the auditor ranks the audit universe by risk and plans engagements accordingly. Within each engagement, the auditor then identifies which controls are meant to reduce those risks and tests them.
How it works
Audit risk
Audit risk is the risk that the auditor reaches the wrong conclusion, for example reporting that controls work when they do not. It has three parts:
| Component | Meaning | Can the auditor change it? |
|---|---|---|
| Inherent risk | Risk of a material error before considering controls | No, it comes from the nature of the area |
| Control risk | Risk that controls fail to prevent or detect the error | No, but the auditor assesses it |
| Detection risk | Risk that the auditor's own procedures miss the error | Yes, through more or better testing |
When inherent and control risk are high, the auditor lowers detection risk with larger samples and stronger procedures.
Planning steps
- Understand the business, its objectives, processes and systems.
- Review prior audit results, regulatory requirements and recent changes.
- Perform a risk assessment of the audit universe.
- Build the audit plan and allocate resources.
- For each engagement, set objectives, scope and criteria, and write an audit program.
Materiality
Materiality is how significant an error or weakness is to the business. In IS audit it is judged by the effect on the business, not just by money: a small control gap in a system that processes all payments can be material.
Types of controls
| By function | Purpose | Example |
|---|---|---|
| Preventive | Stop a problem happening | Segregation of duties, input validation, access control |
| Detective | Find a problem after it happens | Log review, reconciliations, exception reports |
| Corrective | Fix a problem and reduce its effect | Restore from backup, incident response, patching |
| Deterrent | Discourage the act | Warning banners, visible cameras |
| Compensating | Reduce risk when the normal control is not possible | Supervisory review where duties cannot be segregated |
Controls can also be general controls, which apply to the whole IT environment (change management, access security, operations), or application controls, which sit inside one business process (input, processing and output checks).
When an option says to segregate duties but the scenario says the team is too small, look for a compensating control such as independent review of activity logs.
Control objectives
A control objective states what a control should achieve, for example "only authorized changes reach production". Frameworks such as COBIT give control objectives that auditors use as criteria against which to judge what they find.
How the exam asks about this
- "What should the auditor do FIRST when planning?" Understand the business and perform a risk assessment.
- "Which risk can the auditor reduce?" Detection risk.
- "A two-person team cannot segregate duties." Recommend a compensating control such as supervisory review.
What to remember for the exam
- Audit risk = inherent risk, control risk and detection risk.
- Only detection risk is under the auditor's direct control.
- The audit plan follows a risk assessment, not a fixed rotation.
- Materiality considers business impact, not only monetary value.
- Preventive stops, detective finds, corrective fixes, compensating substitutes.
Planning an audit from last year's program without a fresh risk assessment misses new systems and new risks.
Common mistakes
Confusing inherent and control risk. Inherent risk exists before any control is considered.
Treating detective controls as preventive. A log review finds an event; it does not stop it.
Measuring materiality only in money. Regulatory or reputational impact can make a small amount material.
Check yourself
Which component of audit risk can the auditor directly influence?
Detection risk.
What should drive the annual IS audit plan?
A risk assessment of the audit universe.
What is a compensating control?
A control that reduces risk when the primary control cannot be applied, such as supervisory review when duties cannot be segregated.
Topic 2 of 5 in Information Systems Auditing Process
Test yourself on Information Systems Auditing Process
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.