L1 · IS Audit

Why information systems audit exists, what an auditor is actually responsible for, and the vocabulary the rest of the course is built on. Maps mainly to Domain 1 (Auditing Process) with a little of Domain 5.

Exam relevance. D1 is 18% of CISA. This lecture supplies the mindset more than the marks: the auditor evaluates controls; management owns risk. Almost every "what should the auditor do next?" question is answered by that split.

Why IS audit exists

Audit demand comes from governance failure. The lecture opens with Parmalat (2003): executives claimed €4 billion of cash in a Bank of America account that did not exist; five global banks were indicted, and the affair drove ISO 15489 as the international records-management standard.

The pattern behind every scandal of that shape is the same:

Executive misconduct — management takes risky shortcuts for profit.
Gap in corporate management — nobody is watching.
No oversight controls — operation without independent check.

What regulation demands

Regulation sets a minimum level of control and requires two things of an organisation:

Evidence of operational integrity — the business actually behaves as claimed.
Evidence of internal controls — valuable assets are protected, and you can prove it.

The lecture also flags the perpetual tension: management argues regulation reduces profit; regulators argue it prevents the loss. As an auditor you do not take either side — you test whether the required controls exist and operate.

The four words everything hangs on

Term	Definition to memorise	Example
Asset	Anything of value to the organisation	Trademarks, patents, secret recipes, durable goods, data files, people (staff, clients)
Threat	A negative entity that generates an incident which could cause loss if it happens	Attacker, fire, dishonest employee
Vulnerability	The route or weakness a threat exploits	Unpatched server, unlocked wiring closet
Risk	The likelihood and impact of the threat succeeding through the vulnerability	Probability × loss

Auditor responsibility: ensure that assets, threats and vulnerabilities are recognised and addressed so risk is mitigated. The auditor does not remove the risk — management does.

Governance in one paragraph

Governance = the act or process of governing, or overseeing the control and direction of something. In practice, CXOs use their position to set clear operating rules, which become the organisation's culture and are enforced by the rest of the executive team.

The failure mode is always the same: blaming a subordinate worker or "an IT glitch" instead of the control environment → organisational breakdown → loss of trust.

Good governance does four things, and the audit objective is to test whether they happen under formal authorisation and control:

Set the rules
Designate the priorities
Actively monitor risks
Swiftly address improper actions

Three types of audit — know the boundary

Type	Who	Purpose	Who sees the findings
Internal audit / assessment	Own staff	Discover evidence of what is actually happening inside the organisation (self-assessment)	Not shared outside the organisation
External audit	Customer auditing its vendor	Verify integrity of transactions, internal controls, compliance	Customer / vendor relationship
Independent audit	Outside both customer and supplier influence	Licensing, certification, product approval	Regulator / certification body

Trap: "external" does not mean "independent". A customer auditing its supplier is external but has a commercial interest. Independence requires freedom from both sides of the customer–supplier relationship.

Auditor responsibility and the independence test

The auditor holds a fiduciary relationship: acting for the benefit of another person, placing the duty to be fair and honest ahead of your own interest. Three rules follow:

Never put the auditee's interests ahead of the truth.
Provide advice about the internal status of the organisation — accurately.
Remain aware of your responsibility under the applicable auditing standards.

Independence test — the four questions

Are you auditing something you helped to develop? (self-review)
Is your personal life free of relationships, off-duty behaviour or financial gain that could affect judgement?
Any organisational relationship with the auditee — business deals, financial obligations, pending legal action?
Do you receive gifts of value?

Independence in fact (you are unbiased) is not enough — you must also be independent in appearance (a reasonable outsider would agree).

Standards bodies named in the lecture

FASB — Financial Accounting Standards Board
ISACA — IS Audit and Control Association (the CISA body; publishes ITAF)
ISO — International Organization for Standardization
OECD — Organisation for Economic Co-operation and Development
HKSA / HKSRE / HKSAE / HKSIR / HKSRS — Hong Kong standards on auditing, review engagements, assurance engagements, investment circular reporting, and related services

You are not expected to recite the content of each. You are expected to know which body owns IS audit guidance (ISACA / ITAF) and that assurance engagements have their own standard family.

Who owns, who uses, who custodies

Role	Example	Basic responsibilities
Data owner	Vice President	Determine classification · specify controls · appoint the custodian
Data user	Internal business user, business partner, web client	Follow acceptable usage · maintain security · report violations
Data custodian	DBA, production programmer, sysadmin	Protect information · ensure availability · implement and maintain controls · support users

Trap: the owner classifies and authorises. The custodian implements. If a question puts classification authority in the DBA's hands, it is wrong.

"Audit" is a project

The lecture deliberately frames an audit as a project, so project-management standards apply: PMI/PMP, PRINCE2, ISO 21500, and Total Quality Management.

What makes something a project

Temporary — has a beginning and an end.
Unique — done for a unique purpose; creates a product or service.
Progressively elaborated — detail is added as interrelated processes define and control it. (PMI: 44 processes in 5 process groups — a course-slide figure, not a CISA number.)

Triple constraint

Question	Constraint
What work is to be done?	Scope
How long should it take?	Time
What should it cost?	Cost

Move any one and the other two move. That is why an audit that loses resources loses scope — and why scope restriction must be reported, not silently absorbed (see L2).

The technical control sweep

Hardware security

Software security depends on hardware security — phones, tablets, anything doing online transactions or reaching private networks.

Problem	Safeguard
Equipment and removable media stolen or swapped	Locking doors, secured equipment
Security bypassed by changing hardware setup parameters	Lockable cases, keyboards, media drives
Boot media rewritten by unauthorised software	Boot password, read-only media
Unauthorised software run from removable media	Store media in secured areas; port locks

Physical security

Covers "almost everything that happens before a user starts typing", and it is the area organisations most often skip. Safeguards: access only for those who need it; evaluate whether computer-room windows need electronic detection; lock computer rooms; check that equipment does not interfere with other electronic devices.

Data integrity

Integrity = validity of data. It is compromised by human entry errors, transmission errors, software bugs or viruses, hardware malfunction (disk crash), and natural disasters. Safeguards: regular backups, access controls, interfaces that reject invalid input, and error detection/correction when transmitting.

Access control at the perimeter

Staff access cards, alarms, surveillance (entrances, exits, car park)
Proprietary guard force — screen and sign in visitors, interior patrol, escort
Card/smart-card attacks target the cardholder or data owner, the terminal, the issuer, or the software manufacturer. Buying card and reader from one vendor reduces the attack surface.
Universal drive lock secures USB ports, preventing import of viruses, removal of sensitive files, and introduction of unauthorised software.

Malware and attack vocabulary

Type	Defining behaviour
Virus	Replicates and spreads by attaching itself to other programs. Can be benign (a message on a date), annoying (slows performance, alters display) or catastrophic (damages files, destroys data, crashes systems)
Worm	Replicates itself but does not infect other programs
Trojan horse	Allows remote control by an attacker; does not replicate
Dropper	Installs/delivers payload while avoiding anti-virus detection
Bomb	Malicious script or scheduled program that activates on a specific event (erase documents, pop a message)

Denial of service (DoS): the offender overwhelms the victim's network bandwidth or floods the mailbox with spam, denying services the victim is entitled to access or deliver.

Symptoms of virus infection

Changes in program length; changes in file date/time stamp
Longer program load times; slower system operation
Reduced memory or disk space; bad sectors on disk
Unusual error messages; unusual screen activity
Failed program execution; failed system boot

Perimeter and people

Firewall — a system that enforces an access control policy between two networks: perimeter defence, controlling all connections in and out, filtering data by predefined rules, and actively notifying the right people when something suspicious occurs.

Personnel security — every position that touches the system is evaluated from a security perspective, starting with pre-employment screening. The legal agreement should cover the scope of duties, exclusivity of work, and ownership of the work product.

TRAPS — where this lecture gets examined

Auditor ≠ owner of risk. The auditor identifies, tests and reports; management accepts and remediates. Any answer where the auditor "accepts the risk" or "implements the control" is wrong.
Independence has two halves. "In fact" and "in appearance". A true statement about being unbiased is not enough if the appearance is compromised (e.g. auditing a system you designed).
Virus vs worm vs trojan is a pure definition mark: needs a host / self-replicates without a host / does not replicate.
Owner classifies, custodian implements. Do not let an option swap them.
Internal audit findings stay inside the organisation. That is the distinction from external and independent audit.
Physical security is not "someone else's problem". Physical access bypasses logical controls — that link is examined again in L5.

60-second recall

Audit exists because governance fails; regulation demands evidence of integrity and evidence of controls.
Asset = anything of value, including people. Threat generates an incident. Vulnerability is the route exploited. Risk is the combination.
Three audit types: internal (self-assessment, stays inside) · external (customer→vendor) · independent (outside both).
Fiduciary duty: truth ahead of the auditee, and ahead of yourself.
Independence test: self-review · personal life · organisational relationships · gifts.
IS audit standards body = ISACA (ITAF).
Owner classifies · user complies · custodian protects.
Project = temporary + unique + progressively elaborated; triple constraint = scope, time, cost.
Virus attaches to programs · worm self-replicates · trojan allows remote control and does not replicate · bomb waits for a trigger.
DoS denies service by exhausting bandwidth or inbox capacity.
Firewall = access control policy between two networks.
Personnel security starts before employment — screening, then a legal agreement.