Information Systems Auditing Process practice questions

The audit charter grants the IS audit function unrestricted access to the records, systems and personnel it needs.

A refusal of access is a challenge to the audit function's authority. The document that grants that authority is the board-approved audit charter, which typically gives auditors access to all records and systems relevant to an engagement. Pointing the director to the charter, and escalating through audit management if she still refuses, is the right first step. The engagement memo and the audit plan depend on the charter, and the security policy covers ordinary users, not auditors.

1. Identify the issue: the auditee is disputing the auditor's authority.
2. Ask which document grants that authority.
3. Rule out documents that derive from it or govern other users.
4. Refer to the charter, then escalate if the refusal continues.

Exam tip: When an auditee disputes access, the audit charter is the authority to cite.

The audit charter defines which services the audit function provides; a new type of engagement needs a charter change approved by the audit committee.

The charter states the function's purpose and responsibilities. If it covers only assurance, taking on advisory work means acting outside the mandate, however good the safeguards. The chief audit executive should first propose an amended charter that defines advisory engagements and how independence is protected (management keeps decisions, different staff for later audits), and get committee approval. Disclosure and separate staffing are useful safeguards that belong inside that framework, and a flat refusal ignores that advisory work can be done without impairing independence.

1. Note that the request is for a kind of work the charter does not cover.
2. Recall that the charter defines the function's responsibilities.
3. Recognise that safeguards such as separate staffing come after the mandate exists.
4. Amend the charter and obtain audit committee approval first.

Exam tip: New kinds of audit work start with a charter change approved by the audit committee.

ITAF has three layers: mandatory standards, supporting guidelines, and tools and techniques.

ISACA's ITAF sets out IS audit and assurance standards that practitioners must follow, guidelines that help them apply those standards, and tools and techniques that give practical examples. The distinction is about obligation, not about who the auditor works for or the audit subject. The reversed option is the closest distractor and is wrong.

1. Recall ITAF's layers: standards, guidelines, tools and techniques.
2. Ask which layer is compulsory.
3. Reject splits by employer or audit subject.
4. Choose mandatory standards supported by guidelines.

Exam tip: ITAF standards are mandatory; guidelines help you apply them.

ITAF guidelines are not mandatory, but a practitioner who departs from them must be able to justify the departure.

Standards must be met; guidelines describe ways of meeting them. When a guideline's procedure does not fit, the auditor uses professional judgement, chooses a suitable alternative and documents why, so the departure can be justified if challenged. The audit committee does not approve individual procedures, a justified change is not a scope limitation, and applying an unsuitable procedure just because a guideline describes it confuses guidance with requirement.

1. Recall that guidelines support the mandatory standards.
2. Accept that judgement may lead away from a guideline's procedure.
3. Check that the standard is still satisfied.
4. Document and be ready to justify the departure.

Exam tip: You may depart from a guideline, but you must be able to justify it.

ISACA's Code of Professional Ethics requires members to undertake only activities they can reasonably expect to complete with professional competence.

Competence is a professional obligation. With a month before fieldwork, the auditor can build the needed knowledge through training or bring in a qualified expert, so the audit is performed competently. Noting inexperience in the report, reusing an unsuitable program or relying on the owner's assurance all leave the conclusions on weak ground.

1. Spot the issue: the auditor lacks the skills for this engagement.
2. Recall the code's competence principle.
3. Prefer actions taken before the work over disclosures after it.
4. Get the skills or expert support first.

Exam tip: Take on only the audit work you are competent to do, or get the competence first.

The Code of Professional Ethics requires confidentiality of information obtained during audits unless disclosure is required by legal authority.

Auditors must protect the privacy and confidentiality of what they learn, but the code itself allows disclosure that legal authority requires. The right response is to comply, routing the request through the organization's legal counsel and audit management so the scope of the release is verified and recorded. Refusing, waiting for the owner's consent or handing over less than required all fail the legal obligation.

1. Recognise the confidentiality principle.
2. Recall its exception for disclosure required by legal authority.
3. Confirm the request is a legally authorized one.
4. Comply through the proper legal and audit channels.

Exam tip: Audit information stays confidential unless the law requires disclosure.