ITAF: The Standards Framework

What ITAF is

Every profession has a rulebook. Accountants have accounting standards; doctors have clinical guidelines. IS auditors have ITAF, the IT Assurance Framework, published by ISACA.

ITAF tells an IS auditor what they must do on every audit, gives guidance on how to do it, and points to practical tools. The exam rarely asks “what does standard X say?”. Instead it describes a situation, such as an auditor finding fraud or being refused access, and expects you to know which rule applies.

Three layers, from must to might

Layer	Status	What it is
Standards	Mandatory	The minimum requirements for IS audit and assurance work
Guidelines	Not mandatory, but departures must be justified	How to apply the standards in practice
Tools and techniques	Optional	Audit programs, white papers, worked examples

Alongside the standards sits the Code of Professional Ethics, which is also mandatory for members and certification holders.

Three groups of standards

The standards follow the life of an audit, from who the auditor is, to how they do the work, to how they report it.

General standards: about the auditor and the audit function

• Audit charter. Audit’s purpose, authority and responsibilities are written down in a charter approved by the board or audit committee.
• Organisational independence. The audit function isn’t controlled by the people it audits. Reporting to the audit committee is the usual answer.
• Auditor objectivity. Each auditor is unbiased on each job, and is seen to be unbiased.
• Reasonable expectation. The auditor only accepts work that can be completed properly, with enough scope and access. If that changes later, they say so.
• Due professional care. Be careful and sceptical, the way a competent auditor would.
• Proficiency. The team has the skills for the job, or gets them.
• Assertions and criteria. The auditor judges things against clear, suitable yardsticks, such as a company policy, a law, or a framework like COBIT.

Performance standards: about doing the audit

• Risk-based planning. Audit effort goes where the risks are highest.
• Planning, performance and supervision. Each audit is planned, and staff are supervised so the work meets the standards.
• Materiality. Focus on what’s big or important enough to matter.
• Evidence. Get enough reliable evidence to support the conclusions.
• Using the work of other experts. Before relying on someone else’s work, check they’re competent and independent and that their work covers what you need.
• Irregularities and illegal acts. Watch for fraud. If you find signs of it, document it and report it to an appropriate level, promptly.

Reporting standards: about communicating results

• Reporting. The report states the scope, objectives, period, work done, findings, conclusions and any limitations.
• Follow-up. The auditor checks whether management actually did what it agreed to do.

Spot the standard

Situation	Standard involved	What the auditor does
You were on the team that built the system you’re now auditing	Objectivity	Disclose it; another auditor should normally do the review
Management restricts access to a key system halfway through	Reasonable expectation, reporting	Try to resolve it; if not, report the scope limitation
The only evidence is a manager saying “it’s fine”	Evidence	Get documentary or system evidence
A third party’s penetration test or SOC report is offered as evidence	Using the work of others	Check the provider’s competence, independence and the scope of their work
You find signs of fraud	Irregularities	Document, don’t tip anyone off, report to appropriate management or the audit committee
Your team has no cloud skills for a cloud audit	Proficiency	Get training or an expert before proceeding

FYI: older study material numbers the standards (S1, S2, and later 1001, 1201 and so on). The numbers have changed between editions and aren't tested. Learn what each one asks for.

How the exam asks about it

If the question asks…	The answer is usually…
What’s mandatory for an IS auditor?	The ITAF standards (and the Code of Ethics), not guidelines
Can an auditor depart from a guideline?	Yes, if the departure can be justified
What to check before relying on another expert’s work	Their competence, independence and the adequacy of their work
What to do when fraud indicators are found	Document and report to the appropriate level of management
What if an engagement can’t be completed to the standards?	Don’t accept it, or report the limitation

In short

• ITAF (the IT Assurance Framework) is ISACA's framework for IS audit and assurance work.
• It has three layers: standards (mandatory), guidelines (how to apply the standards) and tools and techniques (practical help).
• Standards come in three groups: general (the auditor and the function), performance (doing the work) and reporting (communicating results).
• Departing from a guideline is allowed if the auditor can justify it; not following a standard is a serious matter.
• Key standards to recognise in scenarios: charter, independence, objectivity, reasonable expectation, due care, proficiency, risk-based planning, evidence, using others' work, irregularities, reporting and follow-up.
• The exam tests what each standard requires, not its number.

Exam traps

• Don't memorise standard numbers. Learn what each standard asks the auditor to do.
• Guidelines aren't mandatory, but the auditor must be able to justify not following one.
• Reasonable expectation means only accepting work that can be completed to the standards. It doesn't mean finding every problem.
• Fraud indicators are reported to an appropriate level of management or the audit committee, not to the press or the police by the auditor alone.

Slides

Click the slide and use the arrow keys. F toggles full screen.