Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
ISACA Code of Professional Ethics
Why auditors need a code
People rely on what an auditor says. A board approves a budget, a regulator closes an inquiry, a customer signs a contract, all because an auditor said “this is sound”. That trust only works if auditors are honest, careful and discreet, every time.
ISACA’s Code of Professional Ethics spells out what that means. Every ISACA member and every certification holder agrees to follow it. It’s binding, not optional: failing to comply can lead to an investigation and disciplinary action, up to and including losing the certification.
Think of a doctor. You tell a doctor things you wouldn’t tell anyone else, and you trust them to be competent, to tell you the truth about what they find, and to keep it private. An auditor has a similar relationship with the organisation they audit and the people who rely on the audit.
The seven principles
Here they are in plain language, with what each one looks like in real audit work.
1. Support good standards
Members support and encourage the use of appropriate standards and procedures for governing and managing IT, including audit, control, security and risk management.
In practice: recommending that an organisation adopts a recognised framework, rather than inventing its own rules from scratch.
2. Be objective and careful
Members perform their duties with objectivity, due diligence and professional care, in line with professional standards.
In practice: no favouritism, no shortcuts. If the person being audited is a close friend, or the auditor helped build the system, objectivity is at risk and should be disclosed.
3. Act lawfully and with integrity
Members serve the interests of stakeholders lawfully, keep high standards of conduct and character, and don’t bring discredit on the profession.
In practice: not taking part in, or covering up, anything illegal, and not behaving in a way that would make people distrust auditors in general.
4. Keep information confidential
Members keep the privacy and confidentiality of information obtained in their work, unless disclosure is required by legal authority. That information isn’t used for personal benefit or released to inappropriate parties.
In practice: not chatting about a client’s security weaknesses at a conference, and not buying shares because you saw unpublished results during an audit. But if a court or regulator legally demands records, disclosure is allowed.
5. Stay competent
Members maintain their competence and only undertake activities they can reasonably expect to complete with the necessary skills, knowledge and competence.
In practice: an auditor who has never worked with cloud platforms shouldn’t quietly accept a complex cloud audit. They should get training, bring in an expert, or decline.
6. Report what you found
Members inform appropriate parties of the results of work performed, disclosing all significant facts known to them that, if not disclosed, could distort the reporting of results.
In practice: if the auditor finds something significant, it goes in the report, even if management would rather it didn’t. Leaving out an important fact misleads readers just as much as stating something false.
7. Support education
Members support the professional education of stakeholders to improve understanding of IT governance and management.
In practice: explaining findings in a way people can learn from, mentoring junior staff, sharing knowledge.
When something feels wrong
Ethical questions on the exam usually describe a situation and ask what the auditor should do. A simple approach:
Example. During an audit of a supplier payment system, the head of finance invites the auditor to a free weekend at a holiday home. The gift could compromise objectivity, at least in appearance. The auditor declines and mentions the offer to audit management.
When the code and an instruction from management conflict, the code wins. An auditor can’t be instructed to leave out a significant finding or to hide information from those who need it.
How the exam asks about it
| Scenario | What the code expects |
|---|---|
| A regulator legally demands the audit working papers | Disclose: a legal requirement overrides confidentiality |
| You’re asked to audit something you have no skills in | Get training or expert help, or decline |
| Management asks you to remove a significant finding | Keep it in; include management’s response if they disagree |
| You learn something during an audit that would help you invest | Don’t use it: confidentiality and integrity |
| A close friend runs the area you’re auditing | Disclose the conflict; you may be reassigned |
| What happens if a CISA holder breaks the code? | Investigation and possible disciplinary action, including losing the certification |
In short
- The Code of Professional Ethics applies to all ISACA members and certification holders. Breaking it can lead to an investigation and disciplinary action, including losing the certification.
- There are seven principles: support good standards, act with objectivity and due care, serve stakeholders lawfully, keep information confidential, stay competent, report all significant findings, and support education.
- Confidentiality has a limit: information can be disclosed when a legal authority requires it.
- Competence means only taking on work you can complete with the skills you have, or can get.
- Reporting means disclosing every significant fact you know, because leaving something out can mislead as much as a false statement.
- When the code and an instruction from management conflict, the code wins.
Exam traps
- Confidentiality isn't absolute. A legal requirement, such as a court order, overrides it.
- Taking on an engagement you aren't qualified for breaks the code, even if the result turns out fine. The fix is training, help from an expert, or declining.
- Leaving a significant finding out of a report because management asked breaks the 'inform appropriate parties' principle.
- Using audit information for personal gain (such as trading shares on it) breaks confidentiality, even if nobody else finds out.
- The code is binding for members and certification holders. It's not just guidance.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Seven principles on one page
The code has seven principles. They're easier to remember as one idea: do honest, competent work in the interest of the people who rely on it.
When something feels wrong