Every CISA journey starts with one question: what makes an audit trustworthy? ISACA answers it with its audit standards and its Code of Professional Ethics. This topic opens Domain 1, the Information Systems Auditing Process, which carries 18% of the exam.
ITAF: ISACA's rulebook in three layers
ISACA's IT Assurance Framework (ITAF) has three layers:
| Layer | Status | Purpose |
|---|---|---|
| Standards | Mandatory | What every CISA must do |
| Guidelines | Guidance | How to apply the standards |
| Tools and techniques | Examples | Practical approaches and procedures |
The difference the exam tests: standards are mandatory. Guidelines are not, but if you depart from one, you must be able to justify why.
Three groups of standards
- General standards cover the auditor: the audit charter, organisational independence, objectivity, due professional care and proficiency.
- Performance standards cover how the audit is done: risk-based planning, sufficient and appropriate evidence, supervision, and evaluating the work of other experts.
- Reporting standards cover the results: a clear report and follow-up on management's actions.
Two points to remember:
- The approved audit charter grants the audit function its authority.
- Independence must exist in fact and in appearance.
ISACA Code of Professional Ethics
Every CISA commits to ISACA's Code of Professional Ethics, including objectivity and due care, confidentiality, competence (accept only work you can perform well) and full reporting of significant facts. A breach can lead to disciplinary action.
Practice question
An IS auditor finds that a specific ISACA guideline does not fit the client's environment. What should the auditor do?
- A. Follow the guideline, since guidelines are mandatory
- B. Apply professional judgement and document the justification
- C. Obtain ISACA approval before departing from it
- D. Withdraw from the engagement
Answer: B.
- A is the classic trap: only standards are mandatory, not guidelines.
- C: ISACA does not approve individual engagements.
- D: withdrawing is excessive, because nothing here impairs independence.
For more practice questions like this, visit https://certprepx.com/.
