Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Standards vs. Guidelines vs. Tools
Must, should, may
ISACA publishes three kinds of material for IS auditors, as part of ITAF. The only real question is how much you’re obliged to follow each one.
| Type | Do I have to follow it? | What it is |
|---|---|---|
| Standards | Yes. Mandatory | The minimum requirements for IS audit and assurance work |
| Guidelines | Normally yes, unless you can justify departing | Guidance on how to apply the standards |
| Tools and techniques | No. Optional | Audit programs, white papers, examples and other practical aids |
The Code of Professional Ethics is also mandatory, alongside the standards.
Think of driving. A speed limit is a standard: you must follow it. “Slow down in the rain” is a guideline: sensible, and if you ignore it you’d better have a good reason. A satnav is a tool: handy, entirely optional.
Example. An ISACA audit program for reviewing firewalls suggests testing 25 rules. The auditor tests 10, because the firewall only has 12 rules and two are disabled. That’s fine: an audit program is a tool, and the auditor’s professional judgement decides how to use it.
How the exam asks about it
| If the question asks… | The answer is… |
|---|---|
| What is mandatory for an IS auditor? | The standards (and the Code of Ethics) |
| Can an auditor depart from a guideline? | Yes, if the departure can be justified |
| What is an ISACA audit program? | A tool or technique: optional |
In short
- Standards are mandatory. They set the minimum an IS auditor must do.
- Guidelines explain how to apply the standards. They aren't mandatory, but a departure must be justified.
- Tools and techniques are practical aids such as audit programs and white papers. They're optional.
- When a question asks what is MANDATORY for an IS auditor, the answer is the standards (and the Code of Ethics).
Exam traps
- Guidelines aren't mandatory, but 'ignore them freely' is also wrong: the auditor needs a justification.
- Audit programs published by ISACA are tools, not requirements.
- The Code of Professional Ethics is mandatory too, alongside the standards.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Must, should, may
ISACA publishes three kinds of material for IS auditors. The difference is simply how much you're obliged to follow them.