Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Forensic and Specialized Audits
When the audit might end up in court
Most audits end with a report to management. A forensic audit might end in a courtroom or a disciplinary hearing, where someone’s lawyer will try to show the evidence was mishandled or tampered with. So everything about how evidence is handled has to stand up to that challenge.
Key requirements:
- Preserve evidence first. Secure it before anyone starts looking around.
- Copy, don’t touch. For a computer, make a forensic image (an exact bit-by-bit copy) using a write blocker, and prove the copy is identical by comparing hash values. Analyse the copy, never the original.
- Chain of custody. Keep a record of who collected the evidence, who held it, and what they did with it, at every step. A gap in the record can make the evidence unusable.
- Specialists. Use qualified forensic examiners and involve legal counsel early.
- Discretion. Investigations can wreck reputations, so information is shared strictly on a need-to-know basis.
Digital forensics is covered in more depth in Domain 5.
Who is responsible for fraud?
| Job | Whose |
|---|---|
| Preventing and detecting fraud | Management, through internal controls |
| Thinking about fraud risk when planning and testing | The auditor |
| Reporting signs of fraud | The auditor, to an appropriate level |
| Investigating suspected fraud | Authorised, qualified investigators |
The auditor isn’t expected to find all fraud. They’re expected to use professional scepticism, recognise red flags, and report them properly.
Finding signs of fraud during an audit
- Document the facts.
- Don’t tip anyone off. Don’t confront the person or discuss it with their colleagues.
- Report to audit management and, depending on who might be involved, the audit committee or legal counsel.
- Whether to report externally (to regulators or police) is decided with legal advice, not by the auditor alone.
Example. During a supplier review, the auditor notices that one supplier’s bank account number is the same as an employee’s payroll account. The auditor records the details, doesn’t mention it to the employee or their manager, and reports it to the head of audit, who brings in legal and the audit committee chair.
Relying on someone else’s audit: SOC reports
When an organisation outsources something, like payroll or hosting, it still needs assurance that the provider’s controls work. Auditing every provider directly isn’t practical, so providers hire an independent auditor to examine their controls and write a report their customers can rely on. These are SOC reports (System and Organization Controls).
| Report | Covers | Typically used by |
|---|---|---|
| SOC 1 | Controls relevant to customers’ financial reporting | Customers’ financial auditors |
| SOC 2 | Security, availability, processing integrity, confidentiality, privacy | Customers assessing a provider |
| SOC 3 | A short public summary of a SOC 2 | Anyone |
Type 1 describes whether controls are well designed on one date. Type 2 also tests whether they actually worked over a period (usually 6 to 12 months). Only Type 2 supports relying on the controls for the year.
Before relying on a SOC report
- Scope: does it cover the services and systems you use?
- Period: does it cover your audit period? A bridge letter from the provider covers a short gap.
- Opinion and exceptions: is the opinion clean, and what failed in testing?
- Sub-service providers: are the provider’s own suppliers included or carved out?
- Complementary user entity controls: controls the report assumes you operate, such as reviewing who can access the provider’s system. If you don’t run them, the report’s assurance doesn’t fully apply.
- The service auditor: competent and independent?
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step with a seized hard drive | Make a verified forensic image; work on the copy |
| What preserves the admissibility of evidence? | Chain of custody |
| The auditor suspects fraud during fieldwork | Document and report to appropriate management; don’t confront |
| Who is responsible for detecting fraud? | Management |
| Which report supports reliance on a provider’s controls over a period? | SOC 1 or SOC 2 Type 2 |
| The report covers January to September; the audit year ends in December | Get a bridge letter and consider extra procedures |
In short
- A forensic audit gathers evidence to a standard that will stand up in legal or disciplinary proceedings.
- Evidence must be preserved before analysis, copied without changing it, and tracked with a chain of custody.
- Preventing and detecting fraud is management's job. The auditor considers fraud risk and reports red flags, but isn't expected to find all fraud.
- On suspecting fraud: document, don't tip anyone off, report to an appropriate level, and leave investigation to authorised specialists.
- SOC reports let you rely on a service provider's controls without auditing them yourself. SOC 1 covers financial reporting controls; SOC 2 covers security and related areas.
- Type 1 reports describe design on one date. Type 2 also tests whether controls worked over a period, so it supports reliance.
- Before relying on a SOC report, check its scope, period, exceptions, sub-service providers and the controls you're expected to run yourself.
Exam traps
- The auditor shouldn't confront a suspect or start investigating without authority and expertise.
- Make a verified copy (image) of a seized drive first; never analyse the original.
- A Type 1 report gives no evidence that controls worked during the year.
- A SOC report on the provider doesn't cover the controls YOUR organisation is supposed to operate.
- If the SOC report period doesn't cover your whole year, ask for a bridge letter and consider extra procedures.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Finding signs of fraud during an audit
Relying on someone else's audit
When a company outsources payroll or hosting, its auditors can't visit every provider. Instead, providers hire an independent auditor to write a SOC report, which their customers can rely on.