D1M1: Planning Audits Part 1 Flashcards
What is ITAF?
Information Technology Assurance Framework - A comprehensive practice-setting reference model:
1) Establishes standards that address IS auditor roles and responsibilities; knowledge and skills; and diligence, conduct and reporting requirements
2) Defines terms and concepts specific to IS assurance
3) Provides guidance and tools and techniques on the planning, design and conduct and reporting of IS audit and assurance assignments
What are the typical Audit process phases and subphases?
1) Planning (no official subphases)
2) Fieldwork / documentation
a. Review
b. Evidence gathering
c. Evaluation
3) Reporting / follow up
a. Identify weakness, remediation
What is an audit universe typically comprised of?
All of the relevant processes that represent the blueprint of the enterprise’s business
What are risk factors?
Those factors that influence the frequency and/or business impact of risk scenarios.
Typically rated high, medium, low. Audit plans are then constructed around either high risk areas or combination of high, medium, low – recognizing and considering resource constraints.
What are the steps to perform audit planning?
1) Gain an understanding of the organization’s mission, objectives, purpose and processes, which include information and processing requirements such as availability, integrity, security and business technology and information confidentiality.
2) Gain an understanding of the organization’s governance structure and practices related to the audit objectives
3) Understand changes in business environment of the auditee
4) Review prior work papers
5) Identify stated contents such as policies, standards and required guidelines, procedures and organization structure.
6) Perform a risk analysis to help in designing the audit plan
7) Set the audit scope and audit objectives
8) Develop the audit approach or audit strategy
9) Assign personnel resources to the audit
10 Address engagement logistics
ISACA IS Audit and Assurance Standards – what are the 3 categories?
1) General
- Provide the guiding principles under which the IS assurance profession operates
- Apply to the conduct of all assignments
- Deal with an IS auditor’s ethics, independence, objectivity and due care as well as knowledge, competency and skill
2) Performance Performance deals with the conduct of the assignment: -planning and supervision -scoping -risk and materiality -resource mobilization -supervision and assignment management -audit and assurance evidence -exercising of professional judgment and due care
3) Reporting
- Types of reports
- Means of communication
- Information communicated
Purpose behind ISACA IS audit and assurance guidelines? (3)
1) Help further clarify ISACA standards
2) Help IS auditors implement ISACA standards
3) Help IS auditors justify deviations from ISACA standards
Purpose behind ISACA Code of Professional Ethics?
1) Guides professional/personal conduct of ISACA members and certification holders
2) Aims to instill the importance of ethical and professional behavior in the individuals holding ISACA certification
What is the purpose of each of the below:
1) ISACA Code of Conduct
2) ISACA guidelines
3) ISACA standards
3) ISACA ITAF
1) ISACA Code of conduct applies to the behavior and conduct of IS auditors
2) ISACA guidelines help IS auditors implement ISACA audit and assurance standards and record any deviations
3) ISACA standards apply to the conduct of an IS audit assignment right from the planning to the reporting phase
4) ISACA ITAF reference model enables to seek guidance, research policies and procedures, obtain audit and assurance programs and develop effective reports
What is a business process?
- An interrelated set of cross-functional activities or events that result in the delivery of a specific product or service to a customer
- Controlled by policies, procedures, practices and organizational structures
- Meant to achieve a specific objective
Audit charter
The audit charter serves as an overarching document defining the full scope of audit activities:
- clearly states management’s objectives for the audit function
- Documents the responsibility, authority and accountability of the IS audit function
- Is approved by the highest level of management, such as an audit committee where one is established
- Is changed only if the change is thoroughly justified
Based on the audit charter, the audit function can be engaged in two ways:
1) Engagement letters: Used for particular audit exercises that are initiated in an organization with a specific objective
2) Statements of work: Used to document the scope and objectives of services when IS audit services are provided by an external firm
Management of an IS audit function must ensure:
1) Tasks of the audit team fulfill audit function objectives
2) Audit independence and competence are preserved
3) The IS audit function contributes to the efficient management of IT and achievement of business objectives
4) Provisions for the audit team to stay abreast of changing technology and new audit requirements
5) Provisions for the necessary IT resources to enable IS audits of a highly specialized nature
What is an integrated application environment?
An environment where numerous financial and operational applications function together. Controls are designed and embedded into business applications.
Business process controls assurance involves evaluating what two dimensions?
1) General controls – which exist at the process and activity levels and may be a combination of management, programmed, and manual controls
2) Business process owner-specific controls – such as establishing proper security and segregation of duties (SoD), periodic review and approval of access and application controls within the business process
