L2 · Audit Process

The ten-step CISA audit process end to end: authority, planning, risk, evidence, testing, reporting, follow-up. This is the operational core of Domain 1.

Exam relevance. Domain 1 is 18%. This lecture is where sequence questions live — "what should the auditor do first?" The answer is almost always the step earlier in this list, or "obtain authority/evidence".

The ten steps — learn the order

1. Approve the audit charter / engagement letter
2. Pre-plan the audit
3. Perform risk management
4. Determine whether an audit is necessary
5. Perform the actual audit
6. Gather evidence
7. Perform audit tests
8. Analyse the results
9. Report the results
10. Follow up

An audit is "a series of accepted procedures" that provides reasonable assurance (never absolute) that objectives are met, using professional auditing standards. Everything in the process must be supported by evidence and documentation — the two blanks in the slide.

Step 1 · Authority: charter vs engagement letter

Audit charter

• Purpose: authority to perform an audit.
• Issued by executive management or the board of directors.
• States management's assertion of responsibility, the objectives, and the delegation of authority.
• Outlines the auditor's responsibility, authority and accountability:
  • Responsibility — provide scope with goals and objectives.
  • Authority — the right to perform the audit and obtain relevant access.
  • Accountability — mutual agreement with the audit committee, including reporting requirements.

Engagement letter

Grants authority for an independent external audit. It carries the same three elements in contract form:

• Independence of the auditor (responsibility)
• Evidence of agreement to terms and conditions (authority)
• Agreed completion dates (accountability)

Trap: a project charter authorises a project; an audit charter authorises an audit function; an engagement letter authorises a specific external engagement. Three different documents — do not let an option blur them.

The audit committee

Per the lecture, members are the company's business executives (CXOs) who can read and understand financial statements (balance sheet, P&L, cash flow); an accounting or financial professional is preferred.

Objective: advise the executive accounting officer on internal control strategies, priorities and assurance — with a focus on internal control.

Operating expectations from the slides:

• Maintain a positive working relationship with management, internal auditors and independent auditors.
• Engage outside experts for independent assurance.
• The heads of internal and external audit should have free access to the committee chairperson.
• Meet regularly — usually quarterly.
• Issue the audit charter granting authority for internal audits; the charter is approved by senior management and the committee.

CISA framing / trap. The slide describes members as business executives. CISA and IIA good practice emphasise independence from management — an audit committee composed of the executives it oversees is a self-review weakness. If an exam option offers "independent/non-executive members", prefer it; if asked what the course says, this is the course's list.

Step 2 · Pre-planning

Goal: understand the business and its purpose — before testing anything.

• Comply with professional auditing standards and applicable laws; be ready to justify any deviation (rare).
• Consider the impact of the audit on business operations.
• Understand workflows, purposes and constraints.

Questions the auditor asks

• What industry regulations apply? (accounting, banking, insurance, law, healthcare)
• What are the business cycles and the reporting cycles?
• Which processes are critical for survival?
• Who should be interviewed?
• How are assets managed?
• What is the IS organisational plan and what are the IS goals?

Rule from the lecture: do not audit anything unless you fully understand the business process. Auditing without understanding produces findings that are technically true and commercially useless.

Scope restrictions — what to do

The auditor must document and report significant restrictions on scope, and re-test whether the audit can still meet its objectives (the same logic as a project's triple constraint).

Where scope is restricted, the auditor may need to communicate with the prior auditor — to establish whether the restriction is new, what was previously found, and whether reliance on prior work is still valid.

Step 3 · Risk management and the four responses

Goal: identify potential risks to the organisation.

• Assets that need protection
• Exposures for those assets
• Threats to the assets
• Internal and external sources of threat
• Security issues to be addressed

Step 4 · Is an audit necessary at all?

• If audit functions cannot be performed, communicate with management and the audit committee. An audit without meaningful evidence is useless.
• Define specific requirements; identify third-party providers if needed.
• Communicating with outsourced providers can be difficult — the lecture points to SAS 70 (the predecessor of SOC 1) as the mechanism for gaining assurance over a service organisation's controls.

Step 5 · Performing the actual audit

Staffing

• Build a personnel resource plan: the functions and skill sets the audit requires.
• Match individual skills and knowledge to those needs.
• No single auditor is expert in everything — the auditor acts as project leader/manager and builds a skills matrix.

Using the work of others — four conditions

1. Assess the provider's independence and objectivity.
2. Determine professional competence, qualifications and experience.
3. Agree the scope of work and approach.
4. Determine the level of review and supervision required.

Audit quality control

Use a variety of quality performance metrics: an audit methodology/framework · understanding of auditee needs and expectations · respecting business cycles and deadlines · client interviews and workshops · defined audit performance metrics · measuring plan vs actual · responding to auditee complaints.

Communicating with the auditee

The auditee often feels at a disadvantage, and may feel disillusioned, confused or disconnected. Cover explicitly: purpose, service and scope · problems, constraints and delays · questions and complaints · out-of-scope issues · timing and scheduling · the reporting process · confidentiality · special handling for evidence of irregularities or illegal acts.

Data collection techniques

Classifying controls — two axes

Step 6 · Evidence

Timing matters. Evidence timing means whether evidence arrives when requested or hours/days late. Electronic evidence is only available in a limited window before it is overwritten or the software version changes — which is why evidence is imaged early and hashed.

Evidence life cycle

1. Analysis — samples examined (observation, scientific test)
2. Post-analysis preservation storage — return evidence and samples to secure storage
3. Presentation — evidence and findings presented in support of the report
4. Return to owner — after results are successfully evaluated

Step 7 · Audit tests

Compliance testing tests for the presence or existence of something: that policies and procedures exist, that access rights are as documented, that program change control operates, that audit logs are activated.

Classic example: compare the list of people with physical access to the data against HR's list of current employees.

CAAT — Computer Assisted Audit Tools

• Access and analyse data in the database
• Perform compliance tests
• Perform penetration and vulnerability tests
• Test applications
• Include utility, debug and scanning software, test data, application trace
• Referenced in the audit report; data is downloaded in read-only mode

Step 8 · Analysing results — illegal activity

Internal controls do not eliminate the possibility of irregular or illegal activity.

Irregular activity indicators

• Questionable payments — amounts excessively high or low, failed account reconciliation, payments to government officials or for unspecified services
• Unsatisfactory record control — missing documentation, untimely shredding of documents (against the retention/record life-cycle rules)

Responding to illegal activity

• Establish whether management is aware.
• Document all information, evidence, findings and conclusions.
• Do not contact law enforcement or regulators until advised by the auditor's legal counsel.
• Do not become a party to the suspected activity; seek legal advice if unsure.
• Be prepared for the audit to be terminated.

Trap: "report it to the police immediately" is wrong. The auditor escalates internally, documents, and takes legal advice first.

Step 9 · Reporting

Prepare documentation during the audit so the report can answer: who was involved · what was audited and how evidence was obtained · when · where · why it occurred · how the plan and procedures were executed.

A report covers: audit scope · objectives · methods used · nature of findings · extent of work performed · applicable dates of coverage.

Sampling

Step 10 · Follow-up

• Events occur after the audit is completed.
• The auditor should be concerned about subsequent events that pose a material challenge to the final report.
• It is not the auditor's responsibility to detect all subsequent events.
• May lead to adjustment of the final report depending on the nature of the event.

The slides leave Type 1 / Type 2 as a fill-in. Standard audit meaning (ISA 560 style):

TRAPS

• Charter before plan. No authority, no audit — even if the risk is obvious.
• Understand the business before you test it. Pre-planning precedes risk assessment and fieldwork.
• Reasonable assurance, never absolute. Options promising certainty are wrong.
• Documentation existing ≠ control operating. Design vs operating effectiveness is the whole point of testing.
• Compliance test finds the control; substantive test finds the money. If controls fail, expand substantive testing.
• Scope restriction is reported, not absorbed. And it may force a disclaimer of opinion, not a qualified one, if pervasive.
• Illegal activity: document → escalate → legal counsel → then (maybe) regulators. Never tip off the subject, never destroy evidence.
• Sampling: statistical = quantifiable risk; non-statistical = judgement and bias risk. Fixed-interval ≠ random.
• Follow-up is part of the process, not optional politeness.

60-second recall

• 10 steps: charter → pre-plan → risk → necessity → perform → evidence → test → analyse → report → follow up.
• Charter = standing internal authority (board/audit committee); engagement letter = specific external engagement.
• Responsibility · Authority · Accountability — the three elements in both documents.
• Audit committee meets quarterly; audit heads have direct access to the chair.
• Four risk responses: accept · mitigate · transfer · avoid. Ignoring = accepting.
• Use of others: independence/objectivity · competence · agreed scope · review and supervision.
• Evidence: direct (no inference) vs indirect/circumstantial; life cycle = analysis → preserve → present → return.
• Controls by timing: preventative · detective · corrective. By nature: administrative · technical · physical.
• CAAT: read-only data extraction; compliance, penetration, application testing.
• Illegal acts: fraud · theft · suppression · racketeering · regulatory violation.
• Sampling: statistical (random, cell, fixed interval) vs non-statistical (judgement).
• Report: scope · objectives · methods · findings · extent · dates.
• Subsequent events: Type 1 existed at the date → adjust; Type 2 arose after → disclose.