IS Auditing Process: Exam Tips
Know ISACA Audit Standards Thoroughly
ISACA IT Audit and Assurance Standards (ITAF) define mandatory requirements for IS auditing. Understand the distinction between standards (mandatory), guidelines (recommended), and tools and techniques (supportive).
Risk-Based Audit Planning Is Essential
The IS auditor should prioritize audit areas based on risk assessment, not solely on management requests. A risk-based approach ensures that limited audit resources are allocated to the areas with the highest potential impact.
Distinguish Preventive, Detective, and Corrective Controls
Preventive controls stop events before they occur (e.g., access controls). Detective controls identify events after they happen (e.g., audit logs). Corrective controls remediate issues that have been detected (e.g., incident response procedures).
Evidence Must Be Sufficient and Reliable
Audit evidence should be relevant, reliable, sufficient, and useful. Evidence obtained directly by the auditor (such as observation or re-performance) is generally more reliable than evidence provided by the auditee.
Use Data Analytics for Continuous Auditing
Computer-assisted audit techniques (CAATs) and data analytics enable auditors to test entire populations rather than samples. Continuous auditing and monitoring allow for real-time assurance over automated controls.
Understand Sampling Methodologies and Risk
Statistical sampling provides a mathematically measurable confidence level, while judgmental sampling relies on auditor expertise. Sampling risk is the risk that an auditor's conclusion based on a sample differs from the conclusion of testing the entire population.
Audit Reports Must Be Clear and Actionable
Findings should include condition, criteria, cause, and effect. The audit report should be presented to the appropriate level of management and include practical recommendations with agreed-upon timelines for remediation.
Follow Up on Prior Audit Findings
The IS auditor is responsible for tracking remediation of previously reported findings. If management accepts the risk of not implementing a recommendation, that acceptance must be formally documented and acknowledged by the appropriate authority.
Maintain Independence and Professional Skepticism
Auditors must remain independent in both fact and appearance throughout the engagement. Professional skepticism requires the auditor to critically assess evidence and not accept management assertions at face value.
Quality Assurance Strengthens Audit Credibility
A quality assurance and improvement program (QAIP) ensures audit activities conform to standards. External quality assessments should be conducted at least once every five years by a qualified, independent reviewer.