Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Audit Quality and Using Other Experts' Work
Who audits the auditors?
Audit tells everyone else to check their work, so it had better check its own. ITAF requires audit work to be supervised and reviewed, and audit functions run a quality assurance and improvement program.
| Element | What it involves |
|---|---|
| Supervision | Senior staff guide, monitor and review work during each audit |
| Work paper review | Every work paper reviewed; every finding and conclusion backed by evidence |
| Internal assessment | Ongoing monitoring plus periodic self-assessment against the standards |
| External assessment | A periodic review by an independent, qualified outsider |
| Feedback | Surveys of auditees after audits; lessons learned |
| Performance measures | Plan completion, timeliness, recommendations implemented |
Results of quality reviews go to the head of audit and, for external assessments, to the audit committee. Reviews are done by people who weren’t involved in the work.
Leaning on experts
IS auditors often rely on other people’s work: a penetration testing firm, a lawyer, an actuary, another audit team, or a service provider’s SOC report. That’s sensible, but ITAF requires the auditor to check them out first.
- Competence: qualifications, certifications and experience in this exact area.
- Independence and objectivity: any ties to the auditee, or a stake in the result? A vendor’s own consultants assessing their own product aren’t independent.
- Scope: does the work cover the systems, period and risks the audit needs?
- Quality: are the methods sound and the conclusions supported? The auditor may review the expert’s work papers.
- Enough? Is it sufficient for the audit objectives, or are extra procedures needed?
Responsibility doesn’t move
Using an expert doesn’t transfer responsibility. The IS auditor’s name is on the conclusion, so the IS auditor has to be satisfied that the expert’s work is good enough.
Example. The audit relies on a penetration test commissioned by IT. The auditor checks the testing firm’s credentials and confirms it has no other contracts with IT that could bias it. The test left out the customer portal, which is in the audit’s scope, so the auditor plans extra testing for the portal.
The same thinking applies when external auditors rely on internal audit’s work, or internal audit relies on other assurance providers.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First thing to consider before relying on an expert’s work | Their competence, independence and objectivity |
| The expert’s work doesn’t cover part of the scope | Perform additional procedures |
| Who is responsible for the conclusions when an expert is used? | The IS auditor |
| How audit work quality is ensured during an engagement | Supervision and review of work papers |
| Purpose of an external quality assessment | An independent check that the audit function meets the standards |
In short
- Audit quality comes from supervision, review of work papers, and a quality program with internal and external assessments.
- External assessments are done periodically by an independent, qualified outsider.
- Before relying on an expert's work, the auditor checks their competence, independence and objectivity.
- The auditor also checks the expert's scope, methods and conclusions are good enough for the audit's needs.
- Using an expert doesn't transfer responsibility: the IS auditor still owns the conclusions.
- The same logic applies when external auditors rely on internal audit, or vice versa.
Exam traps
- The auditor can't rely on an expert's report without reviewing its scope and quality.
- A vendor's own consultants assessing their product aren't independent.
- Using an expert doesn't reduce the auditor's responsibility for the opinion.
- Quality reviews should be done by people who weren't involved in the work.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who audits the auditors?
Audit tells everyone else to check their work. So it had better check its own.
Quality is built in during each audit, through supervision and review, and checked across the whole function by internal and external assessments.
Leaning on experts
IS auditors often rely on others: a penetration testing firm, a lawyer, an actuary, another audit team, or a provider's SOC report. That's fine, but only after checking them out.