IS Audit and Assurance Guideline

2001 Audit Charter

The specialised nature of information systems (IS) audit and assurance and the skills necessary to perform such
engagements require standards that apply specifically to IS audit and assurance. The development and

dissemination of the IS audit and assurance standards are a cornerstone of the ISACA professional contribution to
the audit community.

IS audit and assurance standards define mandatory requirements for IS auditing and reporting and inform:
IS audit and assurance professionals of the minimum level of acceptable performance required to meet the
professional responsibilities set out in the ISACA Code of Professional Ethics
Management and other interested parties of the professions expectations concerning the work of practitioners

Holders of the Certified Information Systems Auditor (CISA ) designation of requirements. Failure to comply
with these standards may result in an investigation into the CISA holders conduct by the ISACA Board of
Directors or appropriate committee and, ultimately, in disciplinary action.

IS audit and assurance professionals should include a statement in their work, where appropriate, acknowledging that
the engagement has been conducted in accordance with ISACA IS audit and assurance standards or other
applicable professional standards.

ITAF, a professional practices framework for IS audit and assurance, provides multiple levels of guidance:
Standards, divided into three categories:
- General standards (1000 series)Are the guiding principles under which the IS audit and assurance
profession operates. They apply to the conduct of all assignments, and deal with the IS audit and assurance
professionals ethics, independence, objectivity and due care as well as knowledge, competency and skill.
The standards statements (in bold) are mandatory.
- Performance standards (1200 series)Deal with the conduct of the assignment, such as planning and
supervision, scoping, risk and materiality, resource mobilisation, supervision and assignment management, audit
and assurance evidence, and the exercising of professional judgement and due care
- Reporting standards (1400 series)Address the types of reports, means of communication and the
information communicated
Guidelines, supporting the standards and also divided into three categories:
- General guidelines (2000 series)
- Performance guidelines (2200 series)
- Reporting guidelines (2400 series)
Tools and techniques, providing additional guidance for IS audit and assurance professionals, e.g., white

papers, IS audit/assurance programmes, the COBIT 5 family of products

An online glossary of terms used in ITAF is provided at www.isaca.org/glossary.

Disclaimer: ISACA has designed this guidance as the minimum level of acceptable performance required to meet
the professional responsibilities set out in the ISACA Code of Professional Ethics. ISACA makes no claim that use of
this product will assure a successful outcome. The publication should not be considered inclusive of any proper
procedures and tests or exclusive of other procedures and tests that are reasonably directed to obtaining the same
results. In determining the propriety of any specific procedure or test, controls professionals should apply their own
professional judgement to the specific control circumstances presented by the particular systems or IS environment.

The ISACA Professional Standards and Career Management Committee (PSCMC) is committed to wide consultation
in the preparation of standards and guidance. Prior to issuing any document, an exposure draft is issued
internationally for general public comment. Comments may also be submitted to the attention of the director of
professional standards development via email ([email protected]), fax (+1.847. 253.1443) or postal mail (ISACA
International Headquarters, 3701 Algonquin Road, Suite 1010, Rolling Meadows, IL 60008-3105, USA).

ISACA 2013-2014 Professional Standards and Career Management Committee

Steven E. Sizemore, CISA, CIA, CGAP, Chairperson Texas Health and Human Services Commission, USA
Christopher Nigel Cooper, CISM, CITP, FBCS, M.Inst.ISP HP Enterprises Security Services, UK
Ronald E. Franke, CISA, CRISC, CFE, CIA, CICA Myers and Stauffer LC, USA
Alisdair McKenzie, CISA, CISSP, ITCP IS Assurance Services, New Zealand
Kameswara Rao Namuduri, Ph.D., CISA, CISM, CISSP University of North Texas, USA
Katsumi Sakagawa, CISA, CRISC, PMP JIEC Co. Ltd., Japan
Ian Sanderson, CISA, CRISC, FCA NATO, Belgium
Timothy Smith, CISA, CISSP, CPA LPL Financial, USA
Todd Weinman The Weinman Group, USA
IS Audit and Assurance Guideline 2001 Audit Charter

The guideline is presented in the following sections:

1. Guideline purpose and linkage to standards
2. Guideline content
3. Linkage to standards and COBIT 5 processes
4. Terminology
5. Effective date

1. Guideline Purpose and Linkage to Standards

1.0 Introduction This section clarifies the:
1.1 Purpose of the guideline
1.2 Linkage to standards
1.3 Term usage of audit function and professionals

1.1 Purpose 1.1.1 The purpose of this guideline is to assist IS audit and assurance
professionals in preparing an audit charter. The audit charter defines the
purpose, responsibility, authority and accountability of the IS audit and
assurance function.
1.1.2 IS audit and assurance professionals should consider this guideline when
determining how to implement the standard, use professional judgement in
its application, be prepared to justify any departure and seek additional
guidance if considered necessary.

1.2 Linkage to 1.2.1 Standard 1001 Audit Charter

Standards 1.2.2 Standard 1002 Organisational Independence
1.2.3 Standard 1003 Professional Independence

1.3 Term Usage 1.3.1 Hereafter:

IS audit and assurance function is referred to as audit function
IS audit and assurance professionals are referred to as professionals

2. Guideline Content
2.0 Introduction The guideline content section is structured to provide information on the following
key IS audit and assurance engagement topics:
2.1 Mandate
2.2 Contents of audit charter

2.1 Mandate 2.1.1 Professionals should have a clear mandate to perform the audit function.
This mandate is normally documented in an audit charter that should be
formally approved by those charged with governance, e.g., board of
directors and audit committee. Where an audit charter exists for the audit

2014 ISACA All rights reserved. 2

IS Audit and Assurance Guideline 2001 Audit Charter
2.1 Mandate function as a whole, the IS audit and assurance mandate should be
cont. incorporated.

2.2 Contents of 2.2.1 The audit charter should clearly address the four aspects of purpose,
Audit Charter responsibility, authority and accountability. These aspects are set out in the
following sections.
2.2.2 Purpose of the audit charter and audit function should contain the
following sections:
Aims/goals of the audit charter provide a functional and organisational
framework in which the audit function operates.
Mission statement and objectives of the audit function bring a
structured approach to evaluate and improve the design and
operational effectiveness of the risk management processes, internal
control system and governance structures of information systems.
Scope of the audit function is for either the entire enterprise or a
specific organisation within the enterprise.
Governance details the authorising body for the audit charter and audit
function.
2.2.3 Responsibility of the audit function should contain the following sections:
Operating principles provide a more detailed and quantitative
enumeration of the different objectives of the audit function.
Independence details the implementation of the independence
requirement for the audit function and professionals, as described in
Standards 1002 Organisational Independence and 1003 Professional
Independence.
Relationship with external audit details the relationship of the audit
function with the external auditor:
- Meeting with the external auditors to coordinate the work effort to
minimise duplication efforts
- Providing access to the professionals working papers,
documentation and evidence
- Taking into account the planned work by the external auditors
when drafting the audit plan for the coming period
Auditee expectations details the services and deliverables the auditees
can expect from the audit function and professionals:
- Description of identified problems, consequences and possible
resolutions relating to the area of responsibility of the auditee
- Possibility to include management response and corrective actions
taken on findings in the audit report. This includes references to
related service level agreements (SLAs) for items such as delivery
of reports, response to auditee complaints, quality of service,
review of performance, reporting process and agreement of
findings.
Auditee requirements detail the responsibilities of the auditee, e.g., all
auditees are required to make themselves available and assist the audit
function and professionals in fulfilling assigned responsibilities.

2014 ISACA All rights reserved. 3

IS Audit and Assurance Guideline 2001 Audit Charter
2.2 Contents of Communication with auditees details the frequency and
Audit Charter communication channels through which the audit function will
cont communicate with the auditees.
2.2.4 Authority of the audit function should contain the following sections:
Right of access to relevant information, systems, personnel and
locations by professionals when performing an audit engagement. The
audit function, represented by professionals:
- Is authorised, full, free and unrestricted access to any and all
records, documentation, systems and locations when performing an
audit engagement and can seek assistance from executive
management in obtaining this access
- Has the authority to seek any information from an employee,
consultant or contractor when performing an audit engagement
Limitations of authority of the audit function and professionals, if any
Processes to be audited, which the audit function is authorised to audit,
e.g., the audit function is free to determine the processes it will audit,
based on the risk-based audit plan
2.2.5 Accountability of the audit function should contain the following sections:
Organisational structure, including reporting lines to board and senior
management, of the audit function, e.g., the audit function should have
open and unrestricted access to the board and its members
Reporting that details the format, content and recipients of the
communication on the outcome of every audit engagement, e.g., a
written audit report will be issued by the audit function after every
audit engagement and distributed to the appropriate stakeholders,
including scope, actions performed, findings, recommendations,
managements response and corrective actions taken
Performance of the audit function that details the periodic reporting
process to the board on the performance of the audit function
compared to the audit plan and budget, e.g., the audit function will
report every quarter to the board on its purpose, responsibility and
authority, as well as performance relative to the audit plan and budget
Compliance with standards that details the standards with which the
audit function and professionals will adhere, e.g., the audit function and
professionals will adhere and act according to all the ISACA IS Audit and
Assurance Standards and Guidelines
Quality assurance process (e.g., interviews, customer satisfaction
surveys, assignment performance surveys) that establishes an
understanding of auditees needs and expectations relevant to the
audit function. These needs should be evaluated against the audit
charter with a view to improving the service or changing the service
delivery or audit charter, as necessary. Independent external quality
reviews enable the audit function to assess its compliance with
applicable standards, the enterprises risk and control framework,
optimal use of resources and use of good practices. An independent
external quality review of the audit function should be performed at
least every five years to maintain conformance with the ISACA IS Audit
and Assurance Standards.

2014 ISACA All rights reserved. 4

IS Audit and Assurance Guideline 2001 Audit Charter
2.2 Contents of Staffing rules for audit engagements, e.g., establishing a minimum time
Audit Charter period before which professionals will not be staffed on audit
cont engagements in areas where they performed non-audit services that
impair independence. The audit charter should also establish whether
professionals are permitted to be involved in performing non-audit
services and the broad nature, timing and extent of such services, to
ensure that independence is not impaired. This could eliminate or
minimise the need to obtain specific mandates for each non-audit
service on a case-by-case basis.
Continuous education commitment of the audit function toward the
professionals, e.g., the audit function commits itself to provide
professionals with a minimum of 40 hours of training per year
Agreed actions regarding the audit functions and professionals
behaviour, e.g., penalties when either party fails to carry out its
responsibilities
2.2.6 Other aspects that should be considered to add in the audit charter are:
Reviewing and amending the charter, which is the responsibility of the
audit function. It should periodically assess whether the purpose,
responsibility, authority and accountability, as defined in the audit
charter, continue to be adequate and communicate the result of the
assessment to the audit committee.
Obtaining approval of amendments to the audit charter from those
charged with governance.
Including related documents such as referencing related standards,
guidelines, policies, frameworks, manuals, etc.

3. Linkage to Standards and COBIT 5 Processes

3.0 Introduction This section provides an overview of relevant:
3.1 Linkage to standards
3.2 Linkage to COBIT 5 processes
3.3 Other guidance

3.1 Linkage to The table provides an overview of:

Standards The most relevant ISACA IS audit and assurance standards that are directly
supported by this guideline
Those standard statements that are most relevant to this guideline

Note: Only those standard statements relevant to this guideline are listed.

Standard Title Relevant Standard Statements

1001 Audit Charter The IS audit and assurance function shall document the audit
function appropriately in an audit charter, indicating
purpose, responsibility, authority and accountability.

2014 ISACA All rights reserved. 5

IS Audit and Assurance Guideline 2001 Audit Charter
Standard Title Relevant Standard Statements
1001 Audit charter cont. The IS audit and assurance function shall have the audit
charter agreed upon and approved at an appropriate level
within the enterprise.
1002 Organisational Independence The IS audit and assurance function shall be independent of
the area or activity being reviewed to permit objective
completion of the audit and assurance engagement.
1003 Professional Independence IS audit and assurance professionals shall be independent
and objective in both attitude and appearance in all matters
related to audit and assurance engagements.

3.2 Linkage to The table provides an overview of the most relevant:

COBIT 5 COBIT 5 process
Processes COBIT 5 process purpose
Specific activities performed as part of executing these processes are contained in
COBIT 5: Enabling Processes.

COBIT 5 Process Process Purpose

MEA02 Monitor, evaluate and assess the system of Obtain transparency for key stakeholders on the
internal controls. adequacy of the system of internal controls and,
thus, provide trust in operations, confidence in
the achievement of enterprise objectives and an
adequate understanding of residual risk.

3.3 Other When implementing standards and guidelines, professionals are encouraged to
Guidance seek other guidance when considered necessary. This could be from IS audit and
assurance:
Colleagues from within the enterprise
Management
Governance bodies within the enterprise, e.g., audit committee
Professional organisations
Other professional guidance (e.g., books, papers, other guidelines)

4. Terminology
Term Definition
Audit charter A document approved by those charged with governance that defines the purpose,
authority and responsibility of the internal IS audit and assurance activity

The charter should:

Establish the internal IS audit and assurance functions position within the
enterprise
Authorise access to records, personnel and physical properties relevant to the
performance of IS audit and assurance engagements
Define the scope of the IS audit and assurance functions activities

2014 ISACA All rights reserved. 6

IS Audit and Assurance Guideline 2001 Audit Charter
Term Definition
Audit A specific audit assignment, task or review activity, such as an audit, control self-
engagement assessment review, fraud examination or consultancy.
An audit engagement may include multiple tasks or activities designed to
accomplish a specific set of related objectives.
Independence The freedom from conditions that threaten objectivity or the appearance of
objectivity. Such threats to objectivity must be managed at the individual auditor,
engagement, functional and organisational levels. Independence includes
independence of mind and independence in appearance.

5. Effective Date
5.1 Effective Date This revised guideline is effective for all IS audit and assurance engagements
beginning on or after 1 September 2014.

2014 ISACA All rights reserved. 7