Asked for an Opinion Without the Competence to Give One
Northline Power operates 14 substations on an operational technology (OT) network controlled by SCADA. Internal audit budgeted 400 hours for an OT cybersecurity review. The team consists of a senior auditor with eight years of financial and operational audit experience and a newly hired IT auditor holding a CISSP with no industrial control systems background. The IT director, who owns the SCADA environment, has offered to write the test procedures and to sit with the auditors throughout fieldwork 'to explain anything that looks odd.' The audit committee has asked whether OT cyber risk is adequately managed. The 400-hour budget was set before the scope was expanded to include vendor remote-access controls, and no additional hours have been approved.
1. What does the IPPF require of the activity before it undertakes this engagement, and what are the realistic options?
Read the worked answer
Proficiency is assessed against the engagement, not against the individual's certification.
The activity must collectively possess the knowledge, skills, and other competencies needed. A CISSP establishes general IT security proficiency; it does not establish OT/industrial control system proficiency, where availability and safety constraints invert ordinary IT security logic. The senior auditor's eight years do not fill that gap. The activity therefore does not currently have the competence to deliver the requested opinion.
Options, in order of preference:
- Obtain the competence - engage a qualified OT security specialist (internal or external) to perform or co-lead the technical work, with the CAE confirming the specialist's qualifications and independence.
- Narrow the scope to what the team can competently assess - governance, policy, vendor management, and access-control documentation - and state the technical limits explicitly.
- Defer the engagement until competence and budget exist, and tell the audit committee why.
The budget matters here: 400 hours was priced for a narrower scope, and a review that requires a specialist plus expanded remote-access testing will not fit. Working to an unfunded budget is itself a due professional care problem, because it invites superficial testing.
2. Can internal audit use test procedures written by the IT director, and can he sit in on fieldwork? Analyze.
Read the worked answer
Accepting either as proposed would compromise objectivity and the reliability of the evidence.
The IT director owns the SCADA environment. He is the subject of the review, not a resource for designing it.
- Procedures written by the auditee mean internal audit tests management's own definition of adequate control - a self-assessment wearing an audit label. The auditor must design or at minimum independently evaluate and approve the procedures.
- His presence during fieldwork creates a coaching dynamic: findings get explained away in real time, staff soften observations, and the workpapers record only what survived the conversation. It also gives management visibility into the audit's coverage before conclusions are formed.
What is acceptable:
- Structured walkthroughs and interviews with the IT director, scheduled and documented, with the auditor controlling the agenda.
- Requesting his documented procedures and evidence, then testing against an independent framework.
- A management representative present for safety or access reasons, provided they do not direct the testing and the arrangement is documented.
The safe framing for the CAE: management may inform the audit, never author it.
3. The audit committee wants a conclusion on whether OT cyber risk is adequately managed. How should the report be worded, and how does due professional care set the depth of testing?
Read the worked answer
Due professional care means reasonable care and competence, not infallibility or exhaustive coverage - but it does require the conclusion to match the work done.
On depth: the CAE must apply the care of a reasonably prudent and competent auditor, weighing cost against benefit, materiality, and risk. That justifies risk-based sampling and prioritization; it does not justify a conclusion broader than the evidence. The expanded vendor remote-access scope is a material risk area and cannot simply be dropped without disclosure.
On wording, three defensible formulations depending on what happened:
- Specialist used, scope met: an opinion on the full scope, naming the specialist's role and confirming their independence in the report.
- Scope narrowed: a conclusion expressly limited to the areas assessed - e.g., 'governance, policy, and vendor access documentation are designed adequately; we did not assess technical configuration of the SCADA network, and no conclusion is expressed on it.'
- Competence not obtained and scope not narrowed: no opinion. Report the scope limitation and the reason.
What must not happen: a clean 'risk is adequately managed' sentence issued to satisfy the committee's request. A scope limitation disclosed candidly is a professional result; a confident conclusion the work does not support is the failure the Standard exists to prevent. The CAE should also tell the committee in writing that the 400-hour budget is insufficient for the expanded scope.