What is the primary objective of the Isaca audit standards and professional ethics publication?

For 50 years and counting, ISACA® has been helping information systems governance, control, risk, security, audit/assurance and business and cybersecurity professionals, and enterprises succeed. Our community of professionals is committed to lifetime learning, career progression and sharing expertise for the benefit of individuals and organizations around the globe.

Today, we also help build the skills of cybersecurity professionals; promote effective governance of information and technology through our enterprise governance framework, COBIT® and help organizations evaluate and improve performance through ISACA’s CMMI®. We serve over 165,000 members and enterprises in over 188 countries and awarded over 200,000 globally recognized certifications. ISACA is, and will continue to be, ready to serve you.

Validate your expertise and experience. Whether you are in or looking to land an entry-level position, an experienced IT practitioner or manager, or at the top of your field, ISACA® offers the credentials to prove you have what it takes to excel in your current and future roles.

Take advantage of our CSX® cybersecurity certificates to prove your cybersecurity know-how and the specific skills you need for many technical roles. Likewise our COBIT® certificates show your understanding and ability to implement the leading global framework for enterprise governance of information and technology (EGIT). More certificates are in development. Beyond certificates, ISACA also offers globally recognized CISA®, CRISC™, CISM®, CGEIT® and CSX-P certifications that affirm holders to be among the most qualified information systems and cybersecurity professionals in the world.

ISACA® is fully tooled and ready to raise your personal or enterprise knowledge and skills base. No matter how broad or deep you want to go or take your team, ISACA has the structured, proven and flexible training options to take you from any level to new heights and destinations in IT audit, risk management, control, information security, cybersecurity, IT governance and beyond.

ISACA delivers expert-designed in-person training on-site through hands-on, Training Week courses across North America, through workshops and sessions at conferences around the globe, and online. Build on your expertise the way you like with expert interaction on-site or virtually, online through FREE webinars and virtual summits, or on demand at your own pace.

Get in the know about all things information systems and cybersecurity. When you want guidance, insight, tools and more, you’ll find them in the resources ISACA® puts at your disposal. ISACA resources are curated, written and reviewed by experts—most often, our members and ISACA certification holders. These leaders in their fields share our commitment to pass on the benefits of their years of real-world experience and enthusiasm for helping fellow professionals realize the positive potential of technology and mitigate its risk.

Available 24/7 through white papers, publications, blog posts, podcasts, webinars, virtual summits, training and educational forums and more, ISACA resources.

Author: ISACA
Date Published: 1 January 2020
Download PDF

The specialized nature of information systems (IS) audit and assurance and the skills necessary to perform such engagements require standards that apply specifically to IS audit and assurance. The development and dissemination of the IS audit and assurance standards are a cornerstone of the ISACA professional contribution to the audit community.

IS audit and assurance standards define mandatory requirements for IS auditing. They report and inform:

• IS audit and assurance professionals of the minimum level of acceptable performance required to meet the professional responsibilities set out in the ISACA Code of Professional Ethics
• Management and other interested parties of the profession’s expectations concerning the work of practitioners
• Holders of the Certified Information Systems Auditor (CISA) designation of requirements. Failure to comply with these standards may result in an investigation into the CISA holder’s conduct by the ISACA Board of Directors or appropriate committee and, ultimately, in disciplinary action

ITAF™, 3rd Edition (www.isaca.org/itaf) provides a framework for multiple levels of guidance:

IS Audit and Assurance Standards

The standards are divided into three categories:

• General standards (1000 series)—Are the guiding principles under which the IS assurance profession operates. They apply to the conduct of all assignments and deal with the IS audit and assurance professional’s ethics, independence, objectivity and due care as well as knowledge, competency and skill.
• Performance standards (1200 series)—Deal with the conduct of the assignment, such as planning and supervision, scoping, risk and materiality, resource mobilization, supervision and assignment management, audit and assurance evidence, and the exercising of professional judgment and due care.
• Reporting standards (1400 series)—Address the types of reports, means of communication and the information communicated.

Please note that the guidelines are effective 1 September 2014.

General 1001 Audit Charter 1002 Organisational Independence 1003 Professional Independence 1004 Reasonable Expectation 1005 Due Professional Care 1006 Proficiency 1007 Assertions

1008 Criteria

Performance 1201 Engagement Planning 1202 Risk Assessment in Planning 1203 Performance and Supervision 1204 Materiality 1205 Evidence 1206 Using the Work of Other Experts

1207 Irregularity and Illegal Acts

Reporting 1401 Reporting

1402 Follow-up Activities

The guidelines are designed to directly support the standards and help practitioners achieve alignment with the standards. They follow the same categorization as the standards (also divided into three categories):

• General guidelines (2000 series)
• Performance guidelines (2200 series)
• Reporting guidelines (2400 series)

General 2001 Audit Charter 2002 Organisational Independence 2003 Professional Independence 2004 Reasonable Expectation 2005 Due Professional Care 2006 Proficiency 2007 Assertions

2008 Criteria

Performance 2201 Engagement Planning 2202 Risk Assessment in Planning 2203 Performance and Supervision 2204 Materiality 2205 Evidence 2206 Using the Work of other Experts 2207 Irregularity and Illegal Acts

2208 Sampling

Reporting 2401 Reporting

2402 Follow-up Activities

IS Audit and Assurance Tools and Techniques

These documents provide additional guidance for IS audit and assurance professionals and consist, among other things, of white papers, IS audit/assurance programs, reference books and the COBIT 5 family of products. Tools and techniques are listed under www.isaca.org/itaf.

An online glossary of terms used in ITAF is provided at www.isaca.org/glossary.

Prior to issuing any new standard or guideline, an exposure draft is issued internationally for general public comment.

Comments may also be submitted to the attention of the Director, Content Strategy, via email (); fax (+1.847.253.1755) or postal mail (ISACA International Headquarters, 1700 E. Golf Road, Suite 400, Schaumburg, IL 60173, USA).

Links to current and exposed ISACA Standards, Guidelines, and Tools and Techniques are posted at www.isaca.org/standards.

Disclaimer: ISACA has designed this guidance as the minimum level of acceptable performance required to meet the professional responsibilities set out in the ISACA Code of Professional Ethics. ISACA makes no claim that use of these products will assure a successful outcome. The guidance should not be considered inclusive of any proper procedures and tests or exclusive of other procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific procedure or test, the control professionals should apply their own professional judgment to the specific control circumstances presented by the particular systems or IS environment.

For 50 years and counting, ISACA® has been helping information systems governance, control, risk, security, audit/assurance and business and cybersecurity professionals, and enterprises succeed. Our community of professionals is committed to lifetime learning, career progression and sharing expertise for the benefit of individuals and organizations around the globe.

Today, we also help build the skills of cybersecurity professionals; promote effective governance of information and technology through our enterprise governance framework, COBIT® and help organizations evaluate and improve performance through ISACA’s CMMI®. We serve over 165,000 members and enterprises in over 188 countries and awarded over 200,000 globally recognized certifications. ISACA is, and will continue to be, ready to serve you.

Validate your expertise and experience. Whether you are in or looking to land an entry-level position, an experienced IT practitioner or manager, or at the top of your field, ISACA® offers the credentials to prove you have what it takes to excel in your current and future roles.

Take advantage of our CSX® cybersecurity certificates to prove your cybersecurity know-how and the specific skills you need for many technical roles. Likewise our COBIT® certificates show your understanding and ability to implement the leading global framework for enterprise governance of information and technology (EGIT). More certificates are in development. Beyond certificates, ISACA also offers globally recognized CISA®, CRISC™, CISM®, CGEIT® and CSX-P certifications that affirm holders to be among the most qualified information systems and cybersecurity professionals in the world.

ISACA® is fully tooled and ready to raise your personal or enterprise knowledge and skills base. No matter how broad or deep you want to go or take your team, ISACA has the structured, proven and flexible training options to take you from any level to new heights and destinations in IT audit, risk management, control, information security, cybersecurity, IT governance and beyond.

ISACA delivers expert-designed in-person training on-site through hands-on, Training Week courses across North America, through workshops and sessions at conferences around the globe, and online. Build on your expertise the way you like with expert interaction on-site or virtually, online through FREE webinars and virtual summits, or on demand at your own pace.

Get in the know about all things information systems and cybersecurity. When you want guidance, insight, tools and more, you’ll find them in the resources ISACA® puts at your disposal. ISACA resources are curated, written and reviewed by experts—most often, our members and ISACA certification holders. These leaders in their fields share our commitment to pass on the benefits of their years of real-world experience and enthusiasm for helping fellow professionals realize the positive potential of technology and mitigate its risk.

Available 24/7 through white papers, publications, blog posts, podcasts, webinars, virtual summits, training and educational forums and more, ISACA resources.

Author: ISACA
Date Published: 30 October 2020
Download PDF

The specialized nature of information technology (IT) audit and assurance and the skills necessary to perform such engagements require standards that apply specifically to IT audit and assurance. The development and dissemination of the IT audit and assurance standards are a cornerstone of the ISACA® professional contribution to the audit community.

IT audit and assurance standards define mandatory requirements for IT auditing. They report and inform:

• IT audit and assurance professionals of the minimum level of acceptable performance required to meet the professional responsibilities set out in the ISACA Code of Professional Ethics
• Management and other interested parties of the profession’s expectations concerning the work of practitioners
• Holders of the Certified Information Systems Auditor® (CISA®) designation of requirements. Failure to comply with these standards may result in an investigation into the CISA holder’s conduct by the ISACA Board of Directors or appropriate committee and, ultimately, in disciplinary action.

ITAF™, 4th Edition (www.isaca.org/itaf) provides a framework for multiple levels of guidance:

IT Audit and Assurance Standards
The standards are divided into three categories:

• General standards (1000 series)—Are the guiding principles under which the IT assurance profession operates. They apply to the conduct of all assignments and deal with the IT audit and assurance professional’s ethics, independence, objectivity and due care as well as knowledge, competency and skill.
• Performance standards (1200 series)—Deal with the conduct of the assignment, such as planning and supervision, scoping, risk and materiality, resource mobilization, supervision and assignment management, audit and assurance evidence, and the exercising of professional judgment and due care.
• Reporting standards (1400 series)—Address the types of reports, means of communication and the information communicated.

Please note that the standards and guidelines are effective October 2020.

General 1001 Audit Charter 1002 Organizational Independence 1003 Auditor Objectivity 1004 Reasonable Expectation 1005 Due Professional Care 1006 Proficiency 1007 Assertions

1008 Criteria

Performance 1201 Risk Assessment in Planning 1202 Audit Scheduling 1203 Engagement Planning 1204 Performance and Supervision 1205 Evidence 1206 Using the Work of Other Experts

1207 Irregularities and Illegal Acts

Reporting 1401 Reporting

1402 Follow-up Activities

IT Audit and Assurance Guidelines
The guidelines are designed to directly support the standards and help practitioners achieve alignment with the standards. They follow the same categorization as the standards (also divided into three categories):

• General guidelines (2000 series)
• Performance guidelines (2200 series)
• Reporting guidelines (2400 series)

General 2001 Audit Charter 2002 Organizational Independence 2003 Auditor Objectivity 2004 Reasonable Expectation 2005 Due Professional Care 2006 Proficiency 2007 Assertions

2008 Criteria

Performance 2201 Risk Assessment in Planning 2202 Audit Scheduling 2203 Engagement Planning 2204 Performance and Supervision 2205 Evidence 2206 Using the Work of Other Experts

2207 Irregularities and Illegal Acts

Reporting 2401 Reporting

2402 Follow-up Activities

IT Audit and Assurance Tools and Techniques
These documents provide additional guidance for IT audit and assurance professionals and consist, among other things, of white papers, IT audit/assurance programs, reference books and the COBIT® 2019 family of products.

An online glossary of terms, including terms used in ITAF, is provided at www.isaca.org/glossary.

Prior to issuing any new standard or guideline (or modifying existing standards and guidelines), an exposure draft is issued internationally for general public comment.

Comments may also be submitted to ISACA via email (); fax (+1.847.253.1755) or postal mail (ISACA Global, 1700 E. Golf Road, Suite 400, Schaumburg, IL 60173, USA).

Links to current and exposed ISACA Standards and Guidelines are posted at www.isaca.org/resources/frameworks-standards-and-models.

Disclaimer: ISACA has designed this guidance as the minimum level of acceptable performance required to meet the professional responsibilities set out in the ISACA Code of Professional Ethics. ISACA makes no claim that use of these products will assure a successful outcome. The guidance should not be considered inclusive of any proper procedures and tests or exclusive of other procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific procedure or test, the control professionals should apply their own professional judgment to the specific control circumstances presented by the particular systems or IT environment.