Information Systems Auditing Process
Framing the engagement
An IS audit begins with the audit charter, which grants authority, defines scope and reporting lines, and must originate from the board or audit committee - never from IT management. Independence and objectivity underpin every answer: the auditor may recommend control improvements but must never design or operate a control, because that impairs objectivity. Planning is risk-based: build an audit universe, rank auditable entities by risk, then derive objectives, scope, criteria and an audit program.
Evidence and testing
Use the audit risk model: audit risk = inherent risk × control risk × detection risk. The auditor assesses inherent and control risk; only detection risk is under the auditor's direct control, and it moves inversely with the extent of substantive testing. Evidence reliability runs: auditor's own observation/inspection → external confirmations → independent third-party documents → internal documents → oral representations. Always corroborate management's verbal claims. Separate compliance testing (are controls operating?) from substantive testing (do balances and transactions hold?). Sampling risk falls as sample size grows; non-sampling risk - flawed design or judgment - is never reduced by adding items.
Reporting
Findings follow criteria–condition–cause–effect–recommendation. Present them at the exit meeting to confirm factual accuracy, not to negotiate the opinion.
Traps
Questions swap detection risk (auditor-controlled) with inherent/control risk; ask the auditor to “fix” a finding; or claim that lower reliance on controls means less testing, when it means more.
Rule of thumb
If an answer choice has the auditor design or implement the control, it is wrong.