Information Systems Auditing Process
What this domain tests
Domain 1 covers the mechanics of an IS audit engagement: how the audit function is mandated, how engagements are planned and risk-ranked, how evidence is gathered and judged, and how findings are reported and followed up. Questions are scenario-based - you usually have to pick the next audit action or the most reliable evidence, not define a term.
Charter, independence and planning
The audit charter, approved by the board or audit committee, grants authority and defines scope; it is the auditor's main structural defence of independence. The IS audit function should report to the audit committee rather than the CIO, and should not design or operate the controls it later reviews. Planning is risk-based: build the audit universe, assess inherent and control risk for each auditable entity, then direct scarce resources toward the highest residual risk. Every engagement needs documented objectives, scope, criteria and an audit programme that maps each test to a control objective.
Evidence and testing
Persuasiveness of evidence generally runs: the auditor's own observation or re-performance and system-generated data, then externally produced documents, then internally produced documents, then oral testimony. Reliability rises with the independence of the source, timeliness, and control over how the evidence was created. Compliance testing asks whether a control operated (vouching approvals); substantive testing asks whether the underlying data or result is correct (recomputing interest). Before sampling, confirm population completeness; then weigh sampling risk against non-sampling risk.
Worked example
An auditor must decide whether terminated staff lost system access within 24 hours. Step 1: obtain the HR termination list and reconcile its record count to payroll headcount to prove the population is complete. Step 2: obtain the user-access log with its own timestamps rather than a supervisor's email confirming removal - contemporaneous system-generated data outranks testimony. Step 3: draw an attribute sample, recompute elapsed hours, and compare the deviation rate with the tolerable rate.
Traps
Treating report issuance as the end of the engagement (findings require follow-up); accepting management's oral assurance as sufficient; letting the auditee select the sample; and confusing a documented control with a control that actually operated.