Each organization should have an audit committee composed of business executives. Each audit committee member is required to be financially literate, with the ability to read and understand financial statements including balance sheets, income statements, and cash flow statements. The audit committee members are expected to have past employment experience in accounting or finance, and hold certification in accounting. A chief executive officer with comparable financial sophistication may be a member of an audit committee.

The purpose of the audit committee is to provide advice to the executive accounting officer concerning internal control strategies, priorities, and assurances. It is unlikely that an executive officer will know every detail about the activities within their organization. In spite of this, executive officers are held accountable for any internal control failures. Audit committees are not a substitute for executives who must govern, control, and manage their organization. The audit committee is delegated the authority to review and challenge the assurances of internal controls made by executive management.

The audit committee is expected to maintain a positive working relationship with management, internal auditors, and independent auditors. The committee manages planned audit activities and the results of both internal and external audits. The committee is authorized to engage outside experts for independent assurance. Both internal auditors and external auditors will have escalation procedures designed to communicate significant weaknesses that have been identified. The auditor will seek to have the weaknesses corrected in order to give a positive assurance that the risk is appropriately controlled and managed. The head of the internal audit and the external audit representative should have free access to the audit committee chairperson. This ensures an opportunity to raise any concerns the auditor may have concerning processes, internal controls, risks, and limitations. This reporting relationship is shown in the following graphic.

The audit committee should meet on a regular basis, at least four times a year, to fulfill this requirement. The Sarbanes-Oxley Act of 2002 (SOX) requires executives to certify that all internal control weaknesses have been discovered, with full disclosure to the audit committee provided every 90 days.

The audit committee is responsible for issuing the audit charter to grant the authority for internal audits. The audit charter should be approved by the highest level of management as well as the audit committee. Authority also needs to be granted for an independent audit. A document called an engagement letter grants authority for an independent external audit.

The audit charter allows the delegation of an audit to an external organization via an engagement letter. The engagement letter helps define the relationship to an independent auditor for individual assignments. The letter records the understanding between the audit committee and the independent auditor.

Engagement letters should include the following:

Every IS auditor will need to provide details when significant restrictions are placed on the scope of an audit. You will need to review your audit objectives and risk strategy to determine whether the audit is still possible and will meet the stated objectives. The audit report should explain specific restrictions and their impact on the audit. If the restrictions preclude the ability to collect sufficient evidence, you should render no opinion or no attestation in the audit.

Examples of restrictions include the following:

Auditors have been known to terminate an engagement if the client places restrictions that are too severe on the audit. It is not unheard of for a client to discharge an auditor after receiving accurate findings that are distasteful to the client. The replacement auditor may need to inquire why a prior auditor is no longer being used by the auditee.

In some instances, the auditee will need to establish a level of communication between the previous auditor and replacement auditor. The purpose of this communication is to ensure that the client is not trying to obstruct truthful findings. Blackouts, or missing audit periods, would be a concern shared by more people than just the auditor. Statement on Auditing Standard 84 (SAS-84) provides additional details if you ever encounter this situation.

Each audit is actually an individual project linked to an ongoing audit program. The IS auditor may be asked to perform a variety of audits, including the following:

To be successful, the auditor needs to engage in a fact-finding mission. You will need to take into consideration business requirements that are unique to the auditee or common to their industry. Each business has its own opportunities, challenges, and constraints. Remember, the purpose of an audit is to help management verify assertions (claims). Proper planning is necessary to ensure that the audit itself does not disrupt the business, or waste valuable resources, including time and money.

Every audit should have a set of requirements and objectives in support of the ongoing program—for example, the controls and efforts necessary to comply with regulations such as SOX. It is not possible to test all the requirements in one monolithic audit, so we break down (decompile) the larger compliance requirements into a series of smaller audits (modular stages):

Scheduling should be mutually agreed upon so there are no surprises. Surprise requests tend to damage the relationship rather than build confidence. Your auditee will wonder whether you are just an incompetent planner or if you have an ulterior motive. Surprises make the auditee leery, if not downright distrustful, of your intentions.

As an auditor, you need to understand the nature of the systems that your client desires to be audited. It would be nearly impossible to audit systems whose mission you do not understand.

During preplanning, it's important to review the capabilities of each member of the audit team. Is each member of the audit team up to the task? The engagement manager or lead auditor should be made aware if a member of the team is missing a certification or a clearance rating necessary to conduct the audit.

In addition, audit plans can change depending on whether the client is using a centralized or distributed system design. The location of IS facilities and personnel will need to be considered.

The auditor needs to demonstrate due care as a professional in both planning and execution. There are a number of definitions for the word care:

Various degrees of care could fall under the definition of due care. The degrees of care are proportional to the level of risk or loss that could occur. Negligence is the absence of care. A conscientious person will exercise due care in the performance of their job. Failure to exercise due care would be negligence.

Every audit is a systematic approach of testing samples of evidence to measure compliance against a designated standard. Anyone with the correct attitude has the potential to be a good auditor after proper training. Let's start with two foundation-level audit objectives:

It is not unusual to discover missing controls or the absence of formally documented legal requirements. Auditors may discover that the auditee's understanding of the requirements is quite vague—but no need to fear, because you can be the super auditor with a solution. You can use a special method called the process technique, invented by Walter Shewhart. Shewhart conceived the quality techniques used by Edwards Deming and Philip Crosby.

The purpose of the process technique is to guide a repeating cycle of constant improvement for a process or system. It can be used to identify specific action items necessary to accomplish vague requirements, such as "maintain adequate security." Let's implement the four basic steps used to perform Shewhart's process technique (Plan, Do, Check, Act):

A really smart auditor will focus on situations that are not normal to determine how decisions are made. Auditors should always be curious about how a decision was reached. What evidence is available to justify the decision? Whose approval was required?

A discussion of the audit process would not be complete without mentioning the specific differences between audits and assessments or control self-assessments. The auditee can work to improve their audit score between audits by using assessments and self-assessment techniques.

As auditors, our goal is to report the truth and to educate our clients. Using traditional audits with a combination of lower-cost assessments will help our client become more successful. Now it's time to move forward into risk management.

After identifying a methodology for risk evaluation and control, the auditor will need to identify potential risks to the organization. The auditee will assist by providing information about their organization.

To properly identify risks, the auditor also needs to identify the following:

Part of documenting risk data is for the auditor to identify potential risk response strategies that can be used in the audit with each identified risk. The four risk responses are as follows:

An assessment of risk will usually include a list of all possible risks that threaten the business and your evaluation of how imminent they are.

Figure 2.3 shows the basic process of responding to risks. A CISA is expected to understand the different types of responses. Risk management principles will apply to your audit planning. Your client will select from similar choices in their decisions about the risks faced by their organization.

Figure 2.3. Risk analysis process flowchart

You will need to have personnel for the audit and to define the audit's organizational structure. You also will need to create a personnel resource plan, which identifies specific functions and skill sets necessary to complete your audit objectives. Individual skills and knowledge should be taken into consideration while planning your audit. Remember, it's impossible for the auditor to be an absolute expert in everything.

You will need to rely on the work of others, including your own audit team members, subcontractors, and possibly members of the client's staff. You should create a detailed staff training plan that is reviewed at least semiannually and before each audit. The time to train or retrain personnel is before the audit begins.

Quality does not happen automatically. It is a methodology that must be designed into your process and not just inspected afterward. Quality control is necessary in every audit.

Let's take a moment to define what quality is and how to recognize quality. We can do this by using three easy-to-remember points:

Audit standards, guidelines, and procedures were developed to promote quality and consistency in a typical audit. The ISACA audit standards were developed to assist CISA auditors in performing audits. Additional guidance can be obtained by reading the ISACA audit guide at www.isaca.org/standards.

Your audit will need a variety of quality performance metrics to ensure success. When designing a quality control process, an auditor should consider doing the following:

Quality can vary according to the requirements set forth by management. The auditor must take all the necessary steps to ensure that audit work is performed with very high standards of quality to generate a high assurance of the truth. Anything less will make you and the images of our profession appear questionable. High standards always bring respect.

The auditor must work with management to define the auditee communication requirements.

As discussed in Chapter 1, the auditee often feels at a disadvantage to the auditor. Without effective communication, the auditee will feel disillusioned, confused, or disconnected from the audit. Each of these conditions would be undesirable; audits without client buy-in would be a major disaster.

It is your job as the auditor to be a "second set of eyes" in reviewing the present condition at the organization. You are responsible for reporting accurate findings to senior management and the audit committee. The audit charter should assist you by defining the required level of auditee communication.

To be effective in your communication, you need to consider several points, including the following:

Nothing will replace the simple act of asking the client what level and frequency of communication they expect. The preceding points are simply a starting position. You should synchronize the auditee communication plan with your own internal audit team communication plans.

During the planning process, the auditor will need to gain approval from management for access to the appropriate staff personnel. A member of the audit team may be assigned to coordinate everyone's schedule.

Now is a good time to introduce some of the data collection techniques that auditors use in audits.

As part of the planning process, the auditor needs to determine how data will be gathered for evidence to support the audit report. To collect useful data, the savvy auditor will use a combination of techniques, including the following:

Each technique has its advantages and disadvantages. For example, surveys offer an advantage of time but have the disadvantages of inconsistency and limited response. A survey cannot detect a personal mannerism such as hesitancy, surprise, or restlessness.

An auditor can observe an auditee during an interview and ask additional probing questions based on the auditee response. The auditor weighs each response in an attempt to create consistent scoring of answers by multiple interview subjects. Interviews consume more time but can gather additional information.

Surveys may execute quickly but carry extra administrative support burdens. It will take time and resources to create the survey, distribute the survey, track responses, provide answer assistance, ensure quality control, and tally the results. Because of human nature, people will seldom answer a survey in a manner that reduces their agenda and perceived value to an organization.

The next step in the planning process is to review the existing internal controls that are intended to prevent, detect, or correct problems. Management is responsible for designating and implementing internal controls to protect their assets. You can obtain initial information about existing controls by reviewing current policies and procedures, and later by interviewing managers and key personnel. The purpose of internal controls can be classified into one of three categories:

Controls from the three mid-level categories are implemented by using one of the following three methods:

The auditor should be concerned with the attitude and understanding demonstrated by the auditee. An excellent exercise is to ask the auditee to which category their control would best apply. You may hear some unique and often incorrect responses. The process of reviewing the controls to prevent, detect, or correct is an excellent awareness generator with your auditee.

Table 2.2 lists some examples of these control types.

When you exercise this awareness game of preventative, detective, and corrective controls, it is interesting to notice how technology-oriented people will provide an overt emphasis on technology, while nontechnology-oriented people will focus on administrative and physical controls. If your background is technology, you will need to consider administrative or physical solutions to approach a reasonable balance of controls. Nontechnology-oriented people will need to force their emphasis to include technical controls and achieve a similar level of balance.

Evidence will either prove or disprove a point. The absence of evidence is the absence of proof. In spite of your best efforts, if you're unable to prove those points, you would receive zero credit for your efforts. An auditor should not give any credit to claims or positive assertions that cannot be documented by evidence. No evidence, no proof equals no credit.

There are two primary types of evidence, according to legal definition:

An auditor should always strive to obtain the best possible evidence during an audit. Using direct evidence is preferable whenever it can be obtained. Indirect evidence represents a much lower value because of its subjective nature. An auditor may find it difficult to justify using indirect evidence unless the audit objective is to gather data after detecting an illegal activity. An audit without direct evidence is typically unacceptable.

You will attempt to gather audit evidence by using similar techniques as a detective. Some of the data you gather will be of high value, and other data may be of low value. You will need to continually assess the quality and quantity of evidence. You may discover evidence through your own observations, by reviewing internal documentation, by using computer assisted audit tools (CAAT), or by reviewing correspondence and minutes of meetings.

Examples of the various types of audit evidence include the following:

All evidence should be reviewed to determine its reliability and relevance. The best evidence will be objective and independent of the provider. The quality of evidence you collect will have a direct effect on the points you wish to prove.

Computer assisted audit tools (CAAT) are invaluable for compiling evidence during IS audits. The auditor will find several advantages of using CAAT in the analytical audit procedure. These tools are capable of executing a variety of automated compliance tests and substantive tests that would be nearly impossible to perform manually.

These specialized tools may include multifunction audit utilities, which can analyze logs, perform vulnerability tests, or verify specific implementation of compliance in a system configuration compared to intended controls.

CAAT includes the following types of software tools and techniques:

Many CAATs have a built-in report writer that can generate more than one type of predefined report of findings on your behalf.

Numerous advantages may exist, but they come at a cost. These expert systems may be expensive to acquire. Specialized training is often required to obtain the skills to operate these tools effectively. A significant amount of time may be required to become a competent CAAT operator.

Some of the concerns for or against using CAAT include the following:

New developments are occurring in legal procedures for courts. The increased use of computers has led to widespread reliance on electronic data records. In the old days, evidence could be discovered by rummaging through printed mail, business records, file cabinets, and the dusty storage warehouse. Electronic record keeping is a wonderful tool for automation, yet it can also perpetuate fraud, intentional omissions, or misrepresentation. Electronic discovery is the investigation of electronic records for evidence to be used in the courtroom.

The new legal standard for electronic discovery is referred to as e-discovery. These rules were created to aid auditors and investigators by requiring owners of electronic records to disclose their existence and to provide the data in a simple easy-to-read format (unencoded). Under e-discovery rules, the party who owns or possesses the data is required to perform the conversion and to certify that the contents are truthful and complete in their representation of the content. Put simply, the data owner is no longer permitted to use unintelligible or secret codes to keep database contents a secret from investigators.

State and federal courts are still debating the final rules for e-discovery. The law recognizes two parties: the producing party, which provides the evidence, and the receiving party, which receives the evidence. Here's what the auditor can expect until a final ruling is ratified:

E-discovery applies to criminal cases and civil lawsuits. The courts have determined that using encryption to hide or to cover illegal activities will result in multiple criminal penalties. Failure to cooperate with e-discovery requests can result in fines or prosecution. E-discovery requests include access to audit company records, HR files, database files, financial systems, and email correspondence.

All evidence is graded according to four criteria. This grading aids the auditor in assessing the evidence value. It is important to obtain the best possible evidence. The four characteristics are as follows:

Table 2.4 lists examples of evidence grading. An IS auditor should always strive to obtain the best evidence, which is shown in the far right column.

Evidence is analyzed by using a structured test method to further determine the value it represents. The audit process itself represents a major portion of preparation work to support the analysis of actual evidence.

It is often a good practice to use video recording to document the test process when the execution of the test method may be challenged—for example, to videotape a forensic computer audit if the results may be subject to dispute by individuals who are unfamiliar with the process.

The evidence grading effort aims to improve the resulting trustworthiness of the evidence. A competent IS auditor who can gather evidence and provide expert analysis with a high evidence trustworthiness rating is quite valuable indeed.

An additional factor to consider in regards to evidence is timing. Evidence timing indicates whether evidence is received when it is requested, or several hours or days later. In electronic systems, the timing has a secondary meaning: Electronic evidence may be available only during a limited window of time before it is overwritten or the software changes to a new version.

We have discussed the character of evidence, evidence grading, and timing. The next section explains the evidence life cycle relating to the legal chain of custody.

The evidence will pass through seven life-cycle phases that are necessary in every audit. Every IS auditor must remain aware of the legal demands that are always present with regard to evidence handling. Failure to maintain a proper chain of custody may disqualify the evidence. Evidence handling is just as important for SOX compliance is it would be for suspected criminal activity. Evidence handling is crucial for compliance to most industry regulations.

The seven phases of the evidence life cycle are identification, collection, initial preservation storage, analysis, post analysis preservation storage, presentation, and return of the evidence to the owner. The entire set of seven phases is referred to as the chain of custody. Let's go down the list one by one:

Figure 2.4 demonstrates the logical flow through the entire chain of custody. A CISA is required to be competent in this evidence life cycle.

Now we will discuss examples of evidence that an IS auditor will typically use during an audit.

Figure 2.4. The evidence life cycle

All auditors are required to prepare a thorough set of audit documentation at the start of each audit. This includes copies of the charter and scope, audit plans, policies, and specific procedures used during the audit. You should record both handling and test procedures. Audit reports are frequently used as evidence in lawsuits and criminal cases of embezzlement or fraud. As you recall, in Chapter 1 we mentioned several cases involving corruption perpetuated by dishonest executives. Professional auditors will need to demonstrate the extent to which they have complied with IS auditing standards.

Your job as an auditor is to provide consistency. All your findings should be repeatable by another auditor. Documentation should include auditor's working notes and evidence necessary to reperform the audit. The key to building a successful practice is to map each of your planned tasks and corresponding findings to a specific point of compliance in the standard or regulation. This mapping may require you to identify the page, paragraph, and line number in the regulation and for each item you will show as compliant or noncompliant. During the audit, you should be preparing records to answer the following questions:

Later, the auditor's final working papers should be placed into an audit documentation archive, including copies of any reports that were issued.

The auditor should always remember that records of each audit may be needed again in the future. Integrated audits such as SAS-94 will have documentation retention requirements equal to the financial statement, typically at least seven years. Financial and internal control records for an integrated audit serve as a matched pair that should not be separated. Records for certain systems or processes may have a retention requirement specified in their service-level agreement or contract. Very specialized systems used in aerospace, life safety, hazardous materials, or the military may be retained for decades.

Let's look at the selection method for your audit samples and begin the move toward actual testing.

Audit samples are selected for the purpose of collecting representative evidence to be subjected to either compliance testing or substantive testing (which is defined later in this chapter). The auditor should consider a selection technique that will provide the most relevant evidence supported by appropriate analytical procedures.

Two basic types of audit samples can be designed by the auditor to fulfill their requirements: statistical and nonstatistical. Figure 2.5 shows the various audit samples, as well as their testing methods. Care is given to the selection process in order to avoid drawing the wrong conclusion from the wrong sample. This is referred to as a sampling risk. Let's look at each of these samples more closely.

Figure 2.5. Audit samples

Compliance testing tests for the presence or absence of something. Compliance testing includes verifying that policies and procedures have been put in place, and checking that user access rights, program change control procedures, and system audit logs have been activated. An example of a compliance test is comparing the list of persons with physical access to the data center against the HR list of current employees.

Compliance testing is based on one of the following types of audit samples:

Substantive testing seeks to verify the content and integrity of evidence. Substantive tests may include complex calculations to verify account balances, perform physical inventory counts, or execute sample transactions to verify the accuracy of supporting documentation. Substantive tests use audit samples selected by dollar value or to project (forecast or estimate) a total for groups with related characteristics.

Substantive testing is based on one of the following types of audit samples:

Used to indicate the maximum number of errors that can exist without declaring a material misstatement.

Regardless of the audit sample and test method used, the auditor is presumed to have a high degree of confidence when the audit coefficient is 95 percent or higher. The audit coefficient represents your level of confidence about the audit results. It is also referred to as a reliability factor.

Just like Leonardo DaVinci and Louis Pasteur, every auditor needs to keep logs documenting their tests, samples, results and observations. The auditor must trace all findings of conformity and nonconformity in their documentation of test results. Always remember your audit test results must be repeatable by another auditor.

Each finding of evidence can be classified into one of these common reporting statements, presented in order of most desirable to least desirable.

Using your audit plan as a roadmap, it's time to analyze the evidence samples. The goal is to determine if the samples tested by the auditor indicate conformity (meets requirement) or nonconformity (fails requirement).

We have two concerns as auditors related to testing: sufficiency of evidence and contradictory evidence. Let's look into this further.

It is management's responsibility to implement the controls and supervision necessary to detect irregularities and potentially illegal acts in their environment. Management is responsible for making written assertions as to their representation of internal controls. Audit plans should include provisions and procedures in the event an auditor encounters irregularities or possibly illegal acts.

Examples of illegal activities include the following:

On the rare occasion that an auditor determines after issuing a final report that one or more auditing procedures have been omitted, it may be necessary to review some of the audit alternatives to compensate for the omission. If the omitted procedures present material bearing on the outcome, and the audit alternatives cannot compensate for the deficiency, canceling the report and reissuing a new report (if appropriate) may be necessary. If the omitted procedures have tangible bearing on the outcome, the auditor should consult with their lawyer for advice concerning any possible avenues or potential legal actions.

After issuing a report, the auditor is required to conduct an exit interview with management to obtain a commitment for the recommendations made in the audit. Management is responsible for acknowledging the recommendations and designating whatever corrective action will be taken, including the estimated dates for the action.

In subsequent audits, you will check whether management honored their commitments to fix or remediate deficiencies found in a prior audit. Occasionally, the deficiencies are left uncorrected because changes in the organizational design or practice have eliminated the conditions of the prior control's weakness. Particular findings may apply to events that are no longer relevant. Otherwise, you expect management to act in a timely manner to correct the deficiency as originally reported.