ITAF-3rd-Edition fmk Eng 1014

A Professional Practices
Framework for
IS Audit/Assurance
ITAF™
3rd Edition
Personal Copy of Deidre Melton (ISACA ID: 462308)

ITAF™: A Professional Practices Framework for IS Audit/ Assurance, 3rd Edition
2
About ISACA®
With more than 115,000 constituents in 180 countries, ISACA® (www.isaca.org) helps business and IT leaders build trust in, and value from,
information and information systems. Established in 1969, ISACA is the trusted source of knowledge, standards, networking, and career
development for information systems audit, assurance, security, risk, privacy and governance professionals. ISACA offers the Cybersecurity
Nexus™, a comprehensive set of resources for cybersecurity professionals, and COBIT®, a business framework that helps enterprises govern
and manage their information and technology. ISACA also advances and validates business-critical skills and knowledge through the globally
respected Certified Information Systems Auditor® (CISA®), Certified Information Security Manager® (CISM®), Certified in the Governance of
Enterprise IT® (CGEIT®) and Certified in Risk and Information Systems ControlTM (CRISCTM) credentials. The association has more than 200
chapters worldwide.
Disclaimer
ISACA has designed and created ITAFTM: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition (the ‘Work’) primarily as an
educational resource for assurance professionals. ISACA makes no claim that use of any of the Work will assure a successful outcome. The
Work should not be considered inclusive of all proper information, procedures and tests or exclusive of other information, procedures and tests
that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, assurance
professionals should apply their own professional judgement to the specific circumstances presented by the particular systems or information
technology environment.
Reservation of Rights
© 2014 ISACA. All rights reserved. No part of this publication may be used, copied, reproduced, modified, distributed, displayed, stored in a
retrieval system or transmitted in any form by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written
authorisation of ISACA. Reproduction and use of all or portions of this publication are permitted solely for academic, internal and non-commercial
use and for consulting/advisory engagements, and must include full attribution of the material’s source. No other right or permission is granted
with respect to this work.
ISACA
3701 Algonquin Road, Suite 1010
Rolling Meadows, IL 60008 USA
Phone: [phone]
Fax: [phone]
Email: [email protected]
Web site: www.isaca.org
Provide Feedback: www.isaca.org/ITAF
Participate in the ISACA Knowledge Center: www.isaca.org/knowledge-center
Follow ISACA on Twitter: https://twitter.com/ISACANews
Join ISACA on LinkedIn: ISACA (Official), http://linkd.in/ISACAOfficial
Like ISACA on Facebook: www.facebook.com/ISACAHQ
ITAF™: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition
Personal Copy of Deidre Melton (ISACA ID: 462308)

3
ITAF™: A Professional Practices Framework for IS Audit/ Assurance, 3rd Edition Acknowledgements
Acknowledgements
ISACA wishes to recognise:
ISACA Board of Directors
Tony Hayes, CGEIT, AFCHSE, CHE, FACS, FCPA, FIIA, Queensland Government, Australia, International President
Allan Boardman, CISA, CISM, CGEIT, CRISC, ACA, CA (SA), CISSP, Morgan Stanley, UK, Vice President
Juan Luis Carselle, CISA, CGEIT, CRISC, Wal-Mart, Mexico, Vice President
Ramses Gallego, CISM, CGEIT, CCSK, CISSP, SCPM, Six Sigma Black Belt, Dell, Spain, Vice President
Theresa Grafenstine, CISA, CGEIT, CRISC, CGAP, CGMA, CIA, CPA, US House of Representatives, USA, Vice President
Vittal Raj, CISA, CISM, CGEIT, CFE. CIA, CISSP, FCA, Kumar & Raj, India, Vice President
Jeff Spivey, CRISC, CPP, PSP, Security Risk Management Inc., USA, Vice President
Marc Vael, Ph.D., CISA, CISM, CGEIT, CRISC, CISSP, Valuendo, Belgium, Vice President
Gregory T. Grocholski, CISA, The Dow Chemical Co., USA, Past International President
Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA, Past International President
Christos K. Dimitriadis, Ph.D., CISA, CISM, CRISC, INTRALOT S.A., Greece, Director
Krysten McCabe, CISA, The Home Depot, USA, Director
Jo Stewart-Rattray, CISA, CISM, CGEIT, CRISC, CSEPS, BRM Holdich , Australia, Director
Credentialing and Career Management Board
Allan Boardman, CISA, CISM, CGEIT, CRISC, ACA, CA (SA), CISSP, Morgan Stanley, UK, Chairman
Bernard Battistin, CISA, CMA, Office of the Auditor General of Canada, Canada
Richard Brisebois, CISA, CGA, Canada
Terry Chrisman, CGEIT, CRISC, GE Money, USA
Erik Friebolin, CISA, CISM, CRISC, CISSP, PCI-QSA, ITIL, USA
Frank Nielsen, CISA, CGEIT, CCSA,CIA, Nordea, Denmark
Hitoshi Ota, CISA, CISM, CGEIT, CRISC, CIA, Mizuho Corporate Bank, Japan
Carmen Ozores Fernandes, CISA, CRISC, Brazil
Steven E. Sizemore, CISA, CIA, CGAP, Texas Health and Human Services Commission, USA
Professional Standards and Career Management Committee
Steven E. Sizemore, CISA, CIA, CGAP, Texas Health and Human Services Commission, USA, Chairman
Christopher Nigel Cooper, CISM, CITP, FBCS, M.Inst.ISP, HP Enterprises Security Services, UK
Ronald E. Franke, CISA, CRISC, CFE, CIA, CICA, Myers and Stauffer LLC, USA
Alisdair McKenzie, CISA, CISSP, ITCP, I S Assurance Services, New Zealand
Kameswara Rao Namuduri, Ph.D., CISA, CISM, CISSP, University of North Texas, USA
Katsumi Sakagawa, CISA, CRISC, PMP, JIEC Co. Ltd., Japan
Ian Sanderson, CISA, CRISC, FCA, NATO, Belgium
Timothy Smith, CISA, CISSP, CPA, LPL Financial, USA
Todd Weinman, CPS, The Weinman Group, USA
Personal Copy of Deidre Melton (ISACA ID: 462308)

4
ITAF™: A Professional Practices Framework for IS Audit/ Assurance, 3rd Edition Table of Contents
Table of Contents
Introduction ..........................................................................................................................................................................................................5
ISACA Code of Professional Ethics ...............................................................................................................................................................8
1. IS Audit and Assurance Standards ..........................................................................................................................................................9
Standards Statements ................................................................................................................................................................................9
General Standards .....................................................................................................................................................................................12
1001 Audit Charter .............................................................................................................................................................................. 13
1002 Organisational Independence ...................................................................................................................................................... 14
1003 Professional Independence ......................................................................................................................................................... 15
1004 Reasonable Expectation .............................................................................................................................................................16
1005 Due Professional Care ................................................................................................................................................................ 17
1006 Proficiency ..................................................................................................................................................................................18
1007 Assertions ................................................................................................................................................................................... 19
1008 Criteria ........................................................................................................................................................................................ 20
Performance Standards ............................................................................................................................................................................22
1201 Engagement Planning ................................................................................................................................................................23
1202 Risk Assessment in Planning ......................................................................................................................................................25
1203 Performance and Supervision ..................................................................................................................................................... 27
1204 Materiality ...................................................................................................................................................................................29
1205 Evidence .....................................................................................................................................................................................31
1206 Using the Work of Other Experts ................................................................................................................................................33
1207 Irregularity and Illegal Acts .........................................................................................................................................................34
Reporting Standards .................................................................................................................................................................................36
1401 Reporting ....................................................................................................................................................................................37
1402 Follow-up Activities ....................................................................................................................................................................39
2. IS Audit and Assurance Guidelines .......................................................................................................................................................40
General Guidelines ...................................................................................................................................................................................40
2001 Audit Charter ..............................................................................................................................................................................41
2002 Organisational Independence .....................................................................................................................................................45
2003 Professional Independence ......................................................................................................................................................... 49
2004 Reasonable Expectation .............................................................................................................................................................58
2005 Due Professional Care ................................................................................................................................................................63
2006 Proficiency ..................................................................................................................................................................................67
2007 Assertions ..................................................................................................................................................................................72
2008 Criteria .......................................................................................................................................................................................77
Performance Guidelines ............................................................................................................................................................................82
2201 Engagement Planning .................................................................................................................................................................83
2202 Risk Assessment in Audit Planning .............................................................................................................................................88
2203 Performance and Supervision .....................................................................................................................................................95
2204 Materiality ................................................................................................................................................................................102
2205 Evidence ................................................................................................................................................................................... 108
2206 Using the Work of Other Experts .............................................................................................................................................. 114
2207 Irregularity and Illegal Acts ....................................................................................................................................................... 119
2208 Sampling ..................................................................................................................................................................................127
Reporting Guidelines ............................................................................................................................................................................... 133
2401 Reporting .................................................................................................................................................................................. 134
2402 Follow-up Activities .................................................................................................................................................................. 141
3. IS Audit and Assurance Tools and Techniques .............................................................................................................................. 147
Personal Copy of Deidre Melton (ISACA ID: 462308)

ITAF™: A Professional Practices Framework for IS Audit/ Assurance, 3rd Edition Introduction
5
Introduction
ITAF is a comprehensive and good-practice-setting reference model that:
• Establishes standards that address IS audit and assurance professional roles and responsibilities; knowledge and skills; and diligence, conduct
and reporting requirements
• Defines terms and concepts specific to IS assurance
• Provides guidance and tools and techniques on the planning, design, conduct and reporting of IS audit and assurance assignments
ITAF is focused on ISACA material and provides a single source through which IS audit and assurance professionals can seek guidance, research
policies and procedures, obtain audit and assurance programmes, and develop effective reports.
ITAF 2nd Edition incorporated ISACA IS audit and assurance standards and guidance effective 1 November 2013. ITAF 3rd Edition incorporates
guidelines effective 1 September 2014. As new guidance is developed and issued, it will be indexed within the framework.
The ISACA Professional Standards and Career Management Committee is committed to wide consultation in the preparation of IS audit and
assurance standards and guidance. Prior to issuing any document, an exposure draft is issued internationally for general public comment. An
online questionnaire accompanies the exposure draft and will be available at www.isaca.org/standardexposure. Comments may also be submitted
via email to the attention of the director of professional standards development at [email protected].
Frequently asked questions:
• To whom does ITAF apply? ITAF applies to individuals who act in the capacity of IS audit and assurance professionals and are engaged in
providing assurance over some components of IS applications and infrastructure. However, care has been taken to design these standards,
guidelines, and tools and techniques in a manner that may also be useful and provide benefits to a wider audience, including users of IS audit
and assurance reports.
• When should ITAF be used? The application of the framework is a prerequisite to conducting IS audit and assurance work. The standards are
mandatory. The guidelines, tools and techniques are designed to provide non-mandatory assistance in performing assurance work.
• Where should ITAF IS audit and assurance standards and related guidance be used? ITAF’s design recognises that IS audit and assurance
professionals are faced with different requirements and types of assignments—ranging from leading an IS-focused audit to contributing to a
financial or operational audit. ITAF is applicable to any formal IS audit or assessment engagement.
• Does ITAF address requirements for consultative and advisory work? In addition to assessment work, IS audit and assurance professionals
frequently undertake consultative and advisory engagements for their employers or on behalf of clients. These assignments usually result in
an assessment of a particular area; identification of issues, concerns or weaknesses; and the development of recommendations. For a number
of reasons, including nature of the work, scope of the engagement, independence and degree of testing, the work is not considered an audit
and, therefore, the IS audit and assurance professional does not issue a formal audit report. ITAF has not been designed to address specific
requirements with respect to this consultative and advisory work.
Organisation
ITAF IS audit and assurance standards are divided into three categories:
• General standards (1000 series)—Are the guiding principles under which the IS assurance profession operates. They apply to the conduct of
all assignments, and deal with the IS audit and assurance professional’s ethics, independence, objectivity and due care as well as knowledge,
competency and skill.
• Performance standards (1200 series)—Deal with the conduct of the assignment, such as planning and supervision, scoping, risk and
materiality, resource mobilisation, supervision and assignment management, audit and assurance evidence, and the exercising of professional
judgement and due care
• Reporting standards (1400 series)—Address the types of reports, means of communication and the information communicated
ITAF IS audit and assurance guidelines provide the IS audit and assurance professional with information and direction about an IS audit or
assurance area. In line with the three categories of standards outlined above, guidelines focus on the various audit approaches, methodologies
and related material to assist in planning, executing, assessing, testing and reporting on IS processes, controls and related IS audit or assurance
initiatives. Guidelines also help clarify the relationship between enterprise activities and initiatives, and those undertaken by IT.
Personal Copy of Deidre Melton (ISACA ID: 462308)