The Information Systems Audit and Control Association (ISACA) set forth a code governing the professional conduct and ethics of all certified IS auditors and members of the association. As a CISA, you are bound to uphold this code. The following eight points represent the true spirit and intent of this code:

Ethics statements are necessary to demonstrate the level of honesty and professionalism expected of every auditor. Overall, your profession requires you to be honest and fair in all representations you make. The goal is to build trust with clients. Your behavior should reflect a positive image on your profession. All IS auditors are depending on you to help maintain the high quality and integrity that clients expect from a CISA.

Auditors are bombarded by certain people attempting to sway us from our straight and narrow course of honesty. Seemingly simple violations can become uncontrollable career killers. Do not allow yourself to participate in any situation that could tarnish your image as an auditor. Just having a false reputation of dishonest activity will quash your career like a black plague. Let's look at a few common examples:

An audit is simply a review of past history. The IS auditor is expected to follow the defined audit process, establish audit criteria, gather meaningful evidence, and render an independent opinion about internal controls. The audit involves applying various techniques for collecting meaningful evidence, and then performing a comparison of the audit evidence against the standard for reference.

If the assertions of management and the auditor's report are in agreement, you can expect the results to be truthful. If management assertions and the auditor's report do not agree, that would signal a concern warranting further attention.

Your key to success in auditing is to accurately report your findings, whether good or bad or indifferent. A good auditor will produce verifiable results. No one should ever come in behind you with a different outcome of findings. Your job is to report what the evidence indicates.

We can classify audits into three basic categories. Each of these represents a slightly different level of trust and unique objectives. The purpose is always to determine the truth.

So what will the CISA be asked to look at during an audit? Auditors are called to audit products, processes, and systems. Each of these requires a different approach. Let's review the basic approach required for each of these audits to be successful:

Now we need to move on to the different roles people play in the audit.

As an auditor, you are expected to fulfill a fiduciary relationship. A fiduciary relationship is simply one in which you are acting for the benefit of another person and placing the responsibilities to be fair and honest ahead of your own interest. An auditor must never put the auditee interests ahead of the truth. People inside and outside of the auditee organization will depend on your reports to make decisions.

The auditor is depended on to advise about the internal status of an organization. Audits are different from inspections or assessments because the individual performing the audit must be both objective and impartial. This is a tremendous responsibility.

As stated earlier, the audit is a formal process performed by a qualified independent auditor. To clarify, the following provides a comparison of an audit and assessment:

The primary goal of an assessment is to help the user/staff work toward improving their score. However, the audit is the score that actually counts for regulatory compliance purposes.

Remember that the basic control requirement is to separate the worker from the person providing authorization (separation of duties). Assessments are considered biased because the separation is not clean as it would be under a formal independent audit.

Here is a simple self assessment to help you determine your level of independence:

If any answer is "yes," you are not independent. Any conflicts will place a shadow of doubt on the objectivity of the audit findings. Only internal auditors (whose aim is to improve internal performance) can answer yes and still possibly continue the audit. External auditors are required to remain independent during an independent audit. Any potential conflicts should be disclosed immediately to the lead auditor. You may be reassigned to eliminate the conflict. The lead auditor may determine that the impact is low enough that you can remain in the role as long as the client sponsor is aware of the situation. Attempting to hide the truth is a bad idea. No conflict means you are cleared to proceed.

What if the client asks you to provide advice to their design staff while you are engaged as their external auditor? The unknowledgeable auditor could create a conflict or lose the client's respect. A good auditor would remind the client of the need for auditor independence. Imagine the power of the following statement that you, as a professional auditor, could make:

Auditors have the luxury of being able to rely on well-known accounting standards that have been accepted worldwide. The standards were originally developed for financial audits, but their spirit and intent also apply to IS auditing. Frequently, a minor adaptation will provide the foundation and detail necessary for use in IS audits. These standards allow you to render a fair opinion without fear of retribution or liability.

Understanding the basic types of audits: audits either verify compliance (compliance test) or check the substance and integrity of a claim (substantive test). Just how does an auditor know what to do in these audits? As an IS auditor, you are fortunate to have several credible resources available to assist you and guide your clients.

Among these resources are standards and regulations that direct your actions and final opinion. It would be quite rare to depart from these well-known and commonly accepted regulations. In fact, you would be in an awkward situation if you ever departed from the audit standards. By following known audit standards, you are relatively safe from an integrity challenge or individual liability. By adhering to audit standards, a good auditor can operate from a position that is conceptually equal to Teflon nonstick coating. Nothing negative or questionable could stick to the auditor.

You can learn more about auditing standards by reading and then implementing information provided by the following:

Although this list may appear daunting, it is important to remember that all these examples are in fundamental agreement with each other. Each standard supports nearly identical terms of reference and supports similar audit objectives. These standards will have slightly different levels of audit or audit scope. ITGA and ISACA have developed a set of IT internal control standards for CISAs to follow. These incorporate several objectives of the COSO internal control standard that have been narrowed to focus on IT functions. Let's look at a brief overview of the ISACA standards.

ISACA IS Audit Standards

The members of ISACA are constantly striving to advance the standards of IS auditing. CISAs should check the ISACA website (www.isaca.org) for updates on a quarterly basis. ISACA added five new standards during 2006–2007 to clarify our minimum level of performance. The current body of ISACA Audit Standards is organized using a format numbered from 1 to 16:

S1 Audit Charter

The audit charter authorizes the scope of the audit and grants you responsibility, authority, and accountability in the audit function.

S2 Independence

Every auditor is expected to demonstrate professional and organizational independence.

S3 Professional Ethics and Standards of Conduct

The auditor must act in a manner that denotes professionalism and respect.

S4 Professional Competence

The auditor must have the necessary skills to perform the audit. Continuing education is required to improve and maintain skills.

S5 Planning

Successful audits are the result of advance preparation. Proper planning is necessary to ensure that the audit will fulfill the intended objectives.

S6 Performance of Audit Work

This standard provides guidance to ensure that the auditor has proper supervision, gains the correct evidence to form conclusions, and creates the required documentation of the audit.

S7 Audit Reporting

The auditor report contains several required statements and legal disclosures. This standard provides guidance concerning the contents of the auditor's report.

S8 Follow-up Activities

The follow-up activities include determining whether management has taken action on the auditor's recommendations in a timely manner.

S9 Irregularities and Illegal Acts

This standard outlines how to handle the discovery of irregularities and illegal acts involving the auditee.

S10 IT Governance

This standard covers the authority, direction, and control of the information technology function. Technology is now pervasive in all areas of business. Is the auditee properly managing IT to meet their needs?

S11 Use of Risk Analysis in Audit Planning

This standard provides guidance for implementing a risk-based approach in audit planning. Risk planning is used to determine whether an audit is possible. Auditors always weigh our level of competency to conduct the audit. Audit plans should be structured for the maximum return on investment when designing specific audits, aka impact for the dollar spent.

S12 Audit Materiality

Auditors must use evidence that portrays the most accurate story. The absence of controls or a potential weakness may cumulatively result in unacceptable risk to the organization. Ineffective controls, absence of controls, and control deficiencies should be disclosed in the audit report.

S13 Using the Work of Other People

It's impossible for the auditor to perform all the work alone. The work of other experts may be included in the audit, provided the auditor is satisfied with their competencies, relevant experience, professional qualifications, independence, and quality control. A scope limitation may be required in the final audit opinion if the other experts do not provide appropriate and sufficient evidence. An expert working in the same area as the one being audited should not be relied on.

S14 Proper Audit Evidence

Appropriate evidence includes the written procedures performed by the auditor, source documents, corroborating records, samples, and corresponding test results. Reliable evidence is based on its source, natural state, and authenticity. Audit evidence must be specifically identified, cataloged, and cross-referenced in the audit documentation, via auditor notes and working papers.

S15 Effective IT Controls

Working IT controls represent an integral foundation in the organization's overall internal control environment. IS auditors should monitor and evaluate the effect or absence of IT controls. It's necessary to help management understand the IT controls' design, implementation, and methods of improvement. The level of effective controls provided by outsourcing, or their absence, may help or hurt the organization.

S16 Electronic Commerce Controls

E-commerce allows the business to conduct electronic transactions with other businesses (business-to-business, or B2B) and directly to consumers (business-to-consumer, or B2C) over the public Internet. E-commerce requires the auditor to implement risk-based audit plans with data-gathering techniques for continuous assurances regarding the security and integrity of the environment. ISACA standard S16 excludes non-Internet-based private networks such as Electronic Data Interchange (EDI) and Society for Worldwide Interbank Financial Telecommunication (SWIFT).

Note

This chapter, as well as Chapter 2, "Audit Process," thoroughly discusses all the objectives contained in ISACA's audit standards.

During the audit process, you will find clients are more receptive when your audit goals are linked to specific citations in the audit standards. You should aim to fill a known and defined point of compliance rather than provide a vague statement relating to something you may have read in a textbook. Don't make the mistake of trusting your job to misinformation, rumors, or free advice on the Internet.

Most of the IT controls originated from demands imposed by a government agency. Security started in the military. Budgets and financial tracking were introduced by the banking industry. In fact, the first internal control in business was the budget. Since 1998, additional internal controls have been added each year. Figure 1.2 demonstrates the relationship of these various sources.

Figure 1.2. Where I.T. control standards originate

Let's review the basic purpose of several major regulations (see Figure 1.3). These are predominantly U.S. regulations with worldwide compliance implications due to global outsourcing.

Every regulation is designed to mandate the minimum acceptable requirements when conducting any form of business within that specific industry. The auditor must remain aware of two types of statements contained in all regulations:

IS auditors may be engaged in a variety of audits. The only fundamental difference between internal and external audits is auditor independence. Although the focus and nature of the audit may vary from time to time, your audit function and responsibilities will remain constant.

Government interpretation of laws and regulations has determined that financial audits and internal controls are interrelated. You could not ensure the integrity of one without verifying the other. As an example, consider the requirements specified under SOX for public corporations. There are two critical reporting functions that management must fulfill under SOX:

Management must make their assertions of compliance without reliance on the auditor. The intention of these two statements is to bind management with liability. SOX is essentially a disclosure law. Its purpose is to provide government authorities with a method of ensuring criminal prosecution of corporate officers if management misrepresents the truth.

As an IS auditor, you should remain aware of your leadership responsibilities.

The client entrusts the auditor with sensitive information. A good auditor would never betray that confidence nor allow sensitive information to be revealed at any time. Any breach of confidentiality would be unforgivable. It is conceivable that during your audit, you may discover information that could cause some level of damage to the client if disclosed. You should prepare for the possibility of detecting irregular or even illegal acts that have occurred.

To protect yourself, you must exercise caution and least privilege in all activities. The concept of least privilege refers to providing only the minimum information necessary to complete a required task. It is the auditor's responsibility to implement security controls to maintain confidentiality. An auditor's working papers contain details and secrets that need to be protected. The information you're privy to may be alarming to some, damaging to others, or trigger additional actions by a perpetrator.

To ensure confidentiality, the auditor should adopt the following operating principles:

There is much discussion concerning who should hire the auditor. Is it the client or is it their lawyer? At stake is the legal argument of confidentiality under attorney-client privilege. Most communication between lawyers and the client may be exempt from legal discovery (disclosure).

We suggest that you ask the client. If necessary, the lawyer could issue a letter authorizing the auditor's work on their behalf. As an auditor, you have to be able to do your job without intimidation in order for it to be fair and honest work. This should be spelled out in the audit charter or your engagement letter. A good auditor will leave the legal issues to the lawyers and focus on their job of performing a good audit. Truth often serves as an excellent defense.

In most cases, the archive of the integrated audit may need to be kept for seven years. Each type of audit may have a longer or shorter retention period, depending on the regulations identified during audit planning. If the client loses the files, that would be their problem and not yours.

During an audit, you will be preparing reports and documentation on laptops belonging to members of your audit staff. All members of the audit team should practice good physical security, including using physical cable locks on the laptops and locking up sensitive files each evening or when not in use. You must be wary of prying eyes and big ears. It is advisable for the audit team to implement a designated "war room" as a secure work location. Meetings and interviews with all other persons should occur in a different location that is also safe from prying eyes and ears.

Have you ever felt nervous, threatened, or intimidated? What are your own feelings when you're told an auditor is coming to visit? Nothing launches a person's defensive attitude faster than the threat of an audit. A good auditor understands client expectations and realizes it is necessary to take time to speak with customers who may be curious or nervous.

It is a good idea to alleviate fear and anxiety by implementing the following objectives with your client:

A good auditor spends time planning and setting priorities before commencing an audit. You will need to make plans on how you will be working with your own team. Develop the leadership style you want to implement. The days of Captain Bligh shouting orders "lest ye be flogged" are gone.

Let's look at the characteristics of good leadership:

The audit manager is responsible for creating clearly defined responsibilities and authority. There can be only one boss in order to prevent confusion. It is the responsibility of this one boss to make the hard decisions and answer for the choices made.

A regular schedule of briefings for both the auditee and the audit team are required. All client communication should be vetted before it is shared. Vetting is the process of evaluating and editing words to obtain the desired outcome.

Good auditing is the result of proper planning, not magic or luck. Every audit starts with an audit charter or engagement letter. The customer will define the focus and scope of the audit. It is the auditor's responsibility to gather pre-audit information and develop a schedule integrating the audit team functions with the customer's schedule. To be successful, a project management methodology should be used.

Let's look at a few of the auditor's responsibilities during the planning phase:

A professional auditor provides the auditee with a list of basic requirements and necessary resources well in advance of the audit team arrival.

A good auditor gives plenty of notice as to what they need to perform their job. This includes documentation requests for manuals, policies, and procedures that will be included in the subject of the audit.

The auditor needs to remain fair and objective when executing an audit. As an auditor, you should be consistent and courteous to your clients. Standard terms of reference can be developed to promote respectful and honest interpretation. As an auditor, you should try using the following terms, or something similar:

A good auditor recognizes that some degree of conflict is inevitable and failures are always possible. IS auditors face the challenges of time, money, resources, and attitudes.

These challenges may be with the client or with the auditor. The auditor must always demonstrate professionalism. An exceptional auditor will exercise common sense with a quick response. An exceptional auditor uses past experiences and makes the job look effortless, especially when dealing with change or conflict.

In this Study Guide, we as authors are often implying an external auditor position. This is intentional in order to emphasize auditor independence. However, substantial opportunities exist for both internal and external auditors.

External auditors are paid to be independent reviewers for an organization. Internal auditors can add enormous value to an organization by providing ongoing efforts that help prepare the organization for an external audit. The internal auditor could approach the situation with an attitude of independence even though they will be unable to certify or attest final results. Their expert audit skills could help guide design and remediation efforts at a substantially lower cost than that of their external counterparts.

The audit world revolves around the collection and review of reliable evidence. Without evidence, a claim or assertion is unverifiable and an auditor cannot separate fact from fiction. Good evidence is intended to substantiate a claim or prove the existence of something you have interest in knowing.

A good auditor will use sufficient evidence to formulate their auditor's opinion. No opinion can be formed when you lack evidence of acceptable quantity, relevance, and reliability. Your job is to be a professional skeptic and demand proof in the form of evidence you can verify. The best evidence will need little explanation to interpret. When more judgment is required to understand the evidence, that evidence has decreased value. Your job is to render a score based on the evidence captured during the audit. Having no evidence would warrant a zero score.

Let's suppose you are looking for evidence concerning an existing corporate policy. First, you would look for the policy itself. Is it a paper or electronic document? Documents that cannot be located within a couple of hours could be assumed not to exist. Inability to find the policy would indicate it is not actively used. Now assume the client has found a copy of the policy. Was it easily accessible or covered with dust?

The next step is to verify that you have the current edition. Your audit charter may or may not ask you to review (test) the contents of the policy. Either way, you will need to verify that the policy is actually in use by the client's organization. You might conduct a random survey of workers, asking whether they can show you a current copy of the policy.

Next, you would ask questions to see whether the workers had actually read the document.

However, existence of the policy alone does not meet the evidence rule. The auditee's score would improve as more persons demonstrate that they read the document.

Another method would be to look for notes containing the minutes of meetings where the policy was discussed. It is rare for a policy to exist without some form of questions being raised or argued. Challenges to the policy may exist in emails. You may also ask for a person to perform the tasks related to the policy and observe their actions. Direct observation is powerful evidence. Simply ask the client to reperform a task whenever you want to cut to the heart of a claim. The words show me can invoke either fear or pride depending on the truth of the situation. Once again, no evidence equals no score.

As an IS auditor, it is important for you to be cognizant of whom you should be interviewing, and how long those interviews should take. Every auditor will frequently face a time crunch due to the customer's schedule or other issues. You will need to pay particular attention to the value of the others' time. Consider the work outage created when you take someone out of their job role to spend time with you. Will it be necessary to backfill their position by providing a substitute during this time away?

Think for a moment of what it would cost the organization for a key executive to spend 15 minutes with you. This executive's time may be measured in personal compensation or by the revenue they generate for the organization. Top executives, such as the CEO, will have compensation packages that include both money and substantial shares of stock. Based on total compensation, the CEO may be receiving several thousand dollars per hour or more.

The moral is that to justify 15 minutes of somebody's time, you better have something to discuss that is of greater value than his prorated value to the organization (greater than prorated revenue + compensation). Consider the cost for a meeting of high-level executives. You need to ensure that the time spent is relevant and remains focused on the audit objectives. The savvy auditor respects the value of a person's time.

Every system will have an inherent need for controls. The auditor needs to ensure that discussions occur with the correct individuals concerning appropriate controls. Three basic IT-related roles exist for every system: owner, user, and custodian. Table 1.1 shows examples of individuals with their associated roles and responsibilities.

These individuals don't have to work in the IT department. On the contrary, these roles exist regardless of the individual department boundaries. If someone performs the function, the responsibility of the role applies to that person. No exceptions. If a person performs two roles, two sets of responsibilities apply. If someone performs all three roles, either it's a one-person operation or you need to have a talk about separation of duties and the value of their data.

Businesses are focused on generating money for investors. There will always be some type of management hierarchy in order to maintain control. Government and nonprofit organizations will use a similar control hierarchy; however, the titles will be different. For government and nonprofit organizations, the term mission objectives would be substituted for the term revenue.

Figure 1.4 illustrates a typical business corporation. Let's start at the top of the diagram and work our way down:

Now we will look at the structure of a typical consulting firm. A consulting firm is a hybrid organization. Internal clerical and support functions are similar to those in a typical business. The consulting side of the firm uses functional management positions. The staff is allocated according to temporary project assignments. At the end of each engagement, the staff will be reallocated by either returning to the available resource pool or by becoming unemployed until the next engagement.

Figure 1.5 illustrates the organizational structure of a typical audit firm. We'll review the structure here:

Figure 1.5. A typical auditing firm organizational chart

The purpose of a project is to create a better result than would naturally occur. If you have so much money that you can just write a check for whatever you want, that would not be a project, only an expense. The purpose of a project is to help overcome the limitations of time, resources, and quality. All projects have three characteristics that define it as a project rather than a perpetual ongoing program.

Let's discuss each of these project characteristics as they relate to auditing:

Project management is defined in the PMBOK as the application of knowledge, skills, tools, and techniques to perform the activities needed by your project requirements. A good project manager will use their knowledge of the subject, their knowledge of project management, and all available processes to fulfill the goals of their project.

A simple definition of project management is to balance competing demands. These demands are referred to as the triple constraint. We can define them as competing values of

Think about it: Could you ever satisfy all the items on your to-do list within the budget and available time? Maybe if the scope is small or you win the lottery. Could you finish the project in the time allotted and not fulfill all the to-dos? What effect will time or scope have on your project's objective? Managing competing demands determines whether a security audit is complete when it is due or when all necessary items have been properly audited. The project scope document will help you defend your decision. Project managers and audit managers will have to work with multiple stakeholders while managing the project and the competing demands. Stakeholders are defined as anyone with viable interest in the project. Stakeholders can be above the project manager in the organization, below the project manager, or peers. Stakeholders can also be outside the organization.

It is stressed that the project manager should concentrate on the defined scope of the project. Our motto is that "all the scope and only the scope" should be done. Sometimes the project manager will be required to make difficult decisions to balance the competing demands of scope, time, and cost. This will require negotiation skills or leadership skills to "sell" an unpopular decision.

A project manager must have several levels of knowledge and skills to be successful:

Without all of these elements, the project manager has problems leading to an unsuccessful end. Many times we need some form of "expert judgment" to define our needs. The problem is compounded by a misunderstanding of who is qualified to be an expert.

Without specialized application knowledge and skills, the project manager would not know what specific requirements were needed or specific tasks must be accomplished to fulfill the project goals.

To translate this into controls auditing, the auditor must have the following:

Project managers are not created equal. Their level of authority and influence is dictated by the organizational structure and culture. The same issues exist in managing the audit as would exist when clients are managing their own projects.

Table 1.3 demonstrates the basic differences among management structures and cultures. Every auditor needs to understand the advantages and disadvantages of each.

The PMI standard for project management as defined in the PMBOK is intended to be applied to all sorts of projects in all sorts of environments. The project manager may use all or some of the processes along with their inputs, tools, and techniques, and outputs for the project they are managing. The use of these processes is need based. The PMI processes provide an excellent checklist to prevent errors and omissions in the project management of any specific project.

As previously stated, we look upon the PMI standard as a framework for project management. You and your company define specific specialized processes and procedures to be used for project management within your enterprise. PMI provides this standard for you to measure your internal processes against.

The PMBOK provides a reference for defining the project life cycle. Your organization may decide to modify this life cycle to meet the unique challenges facing your needs. There is also specific definition of a project phase. Consider that each phase:

PMI places the project management framework as defined in the PMBOK into the specialized life cycle and phases that are defined by the organization. The PMBOK focuses on process groups, processes, inputs to processes, tools and techniques used in processes, and outputs from processes.

A simple outline of this framework would look something like this:

The five process groups as defined by PMI are as follows:

Each process group has a general function and contains processes that have specific functions to be accomplished. The process groups are interdependent; changes made in one process group can generate cascading change into another group. Each process group performs the functions indicated by its name:

PMI defines 44 processes that fit into these 5 process groups. As the project runs, changes will be discovered that create a revision in the planning and execution phases. Figure 1.6 illustrates the relationship of each process group.

Figure 1.6. Relationship of process groups

Changes in scope or poor results will force the project manager to loop backward to the sponsor from the initiation phase. Sometimes a project exceeds the scope or needs revision before it can continue. Your sponsor may help or decide to cancel it.

The following information is a quick reference describing the knowledge areas and associated processes. You'll learn where each process fits in to a process group, the actions taken in the process, and the main output or result from the process.

Effective project management requires a significant level of communication and integration. Two of the more common diagramming techniques include Gantt charts and PERT network diagrams. All projects have a critical path of tasks. This critical path represents the minimum steps necessary to complete a successful project. This path is the longest route in the diagram and the shortest time estimate for project completion

Gantt charts (see Figure 1.7) are used to schedule and sequence activities in a waterfall-type representation. Planned activities are shown flowing downward to completion. The figure shows both sequential and concurrent activities in a linear bar-chart-style presentation. Milestones will be identified and progress reported against planned activities. Gantt charts are more simplistic than PERT diagrams. In a typical Gantt chart, the bars show tasks, and diamond symbols indicate milestones. The long, dark overhead bars depict a phase or a section of the schedule. Unfortunately, Gantt charts fail to illustrate the relationships between activities and the most important activities (critical path). Only an idiot would try to manage projects by using a Gantt chart without the critical path clearly identified. To be successful, every Gantt chart should have a matching PERT chart in use.

Figure 1.7. A Gantt chart

Program Evaluation Review Technique (PERT) is used to illustrate the relationship between planned activities (see Figure 1.8). PERT diagramming shows multiple routes through the project activities, as necessary for accomplishing the goal. PERT has two major advantages. First is the ability to demonstrate a critical path. The second advantage is that PERT provides a quantitative measurement tool for risk analysis. It can help measure the risk of delays, failure, and likely completion. The most successful project managers use both Gantt and PERT—Gantt to display resource detail, and PERT to show the current and most up-to-date critical path.

Figure 1.8. A PERT diagram

You can use the critical path method for planning your audit. This is an excellent technique to show your sponsor the effects of any changes or delays in your project activities:

Beginners in project management will often use Microsoft Project to build project plans with primitive Gantt charts. Unfortunately, it is almost impossible to persuade sponsors by using Gantt reports because of the report's serial nature and lack of dependency analysis. PERT analysis is the best method to show the effect of dependencies with quantitative measurement. Advanced project managers use software such as that from Primavera Systems, which provides fabulous reporting features not found in MS Project. If you are an MS Project user, your best chance of survival is to use a PERT reporting add-in such as PERT chart Expert from Critical Tools. This nifty tool will automatically create several of the basic PERT reports using your MS Project activity list.