IS Audit and Assurance Guideline

2008 Criteria
The specialised nature of information systems (IS) audit and assurance and the skills necessary to perform such
engagements require standards that apply specifically to IS audit and assurance. The development and

dissemination of the IS audit and assurance standards are a cornerstone of the ISACA professional contribution to
the audit community.

IS audit and assurance standards define mandatory requirements for IS auditing and reporting and inform:
IS audit and assurance professionals of the minimum level of acceptable performance required to meet the
professional responsibilities set out in the ISACA Code of Professional Ethics
Management and other interested parties of the professions expectations concerning the work of practitioners

Holders of the Certified Information Systems Auditor (CISA ) designation of requirements. Failure to comply
with these standards may result in an investigation into the CISA holders conduct by the ISACA Board of
Directors or appropriate committee and, ultimately, in disciplinary action.

IS audit and assurance professionals should include a statement in their work, where appropriate, acknowledging that
the engagement has been conducted in accordance with ISACA IS audit and assurance standards or other
applicable professional standards.

ITAF, a professional practices framework for IS audit and assurance, provides multiple levels of guidance:
Standards, divided into three categories:
- General standards (1000 series)Are the guiding principles under which the IS audit and assurance
profession operates. They apply to the conduct of all assignments, and deal with the IS audit and assurance
professionals ethics, independence, objectivity and due care as well as knowledge, competency and skill.
The standards statements (in bold) are mandatory.
- Performance standards (1200 series)Deal with the conduct of the assignment, such as planning and
supervision, scoping, risk and materiality, resource mobilisation, supervision and assignment management, audit
and assurance evidence, and the exercising of professional judgement and due care
- Reporting standards (1400 series)Address the types of reports, means of communication and the
information communicated
Guidelines, supporting the standards and also divided into three categories:
- General guidelines (2000 series)
- Performance guidelines (2200 series)
- Reporting guidelines (2400 series)
Tools and techniques, providing additional guidance for IS audit and assurance professionals, e.g., white

papers, IS audit/assurance programmes, the COBIT 5 family of products

An online glossary of terms used in ITAF is provided at www.isaca.org/glossary.

Disclaimer: ISACA has designed this guidance as the minimum level of acceptable performance required to meet
the professional responsibilities set out in the ISACA Code of Professional Ethics. ISACA makes no claim that use of
this product will assure a successful outcome. The publication should not be considered inclusive of any proper
procedures and tests or exclusive of other procedures and tests that are reasonably directed to obtaining the same
results. In determining the propriety of any specific procedure or test, controls professionals should apply their own
professional judgement to the specific control circumstances presented by the particular systems or IS environment.

The ISACA Professional Standards and Career Management Committee (PSCMC) is committed to wide consultation
in the preparation of standards and guidance. Prior to issuing any document, an exposure draft is issued
internationally for general public comment. Comments may also be submitted to the attention of the director of
professional standards development via email (standards@isaca.org), fax (+1.847. 253.1443) or postal mail (ISACA
International Headquarters, 3701 Algonquin Road, Suite 1010, Rolling Meadows, IL 60008-3105, USA).

ISACA 2013-2014 Professional Standards and Career Management Committee

Steven E. Sizemore, CISA, CIA, CGAP, Chairperson Texas Health and Human Services Commission, USA
Christopher Nigel Cooper, CISM, CITP, FBCS, M.Inst.ISP HP Enterprises Security Services, UK
Ronald E. Franke, CISA, CRISC, CFE, CIA, CICA Myers and Stauffer LC, USA
Alisdair McKenzie, CISA, CISSP, ITCP IS Assurance Services, New Zealand
Kameswara Rao Namuduri, Ph.D., CISA, CISM, CISSP University of North Texas, USA
Katsumi Sakagawa, CISA, CRISC, PMP JIEC Co. Ltd., Japan
Ian Sanderson, CISA, CRISC, FCA NATO, Belgium
Timothy Smith, CISA, CISSP, CPA LPL Financial, USA
Todd Weinman The Weinman Group, USA
IS Audit and Assurance Guideline 2008 Criteria

The guideline is presented in the following sections:

1. Guideline purpose and linkage to standards
2. Guideline content
3. Linkage to standards and COBIT 5 processes
4. Terminology
5. Effective date

1. Guideline Purpose and Linkage to Standards

1.0 Introduction This section clarifies the:
1.1 Purpose of the guideline
1.2 Linkage to standards
1.3 Term usage of audit function and professionals

1.1 Purpose 1.1.1 The purpose of this guideline is to assist IS audit and assurance
professionals in selecting criteria, against which the subject matter will be
assessed, that are suitable, acceptable and come from a relevant source.
1.1.2 IS audit and assurance professionals should consider this guideline when
determining how to implement the standard, use professional judgement in
its application, be prepared to justify any departure and seek additional
guidance if considered necessary.

1.2 Linkage to 1.2.1 Standard 1007 Assertions

Standards 1.2.2 Standard 1008 Criteria

1.3 Term Usage 1.3.1 Hereafter:

IS audit and assurance function is referred to as audit function
IS audit and assurance professionals are referred to as professionals

2. Guideline Content
2.0 Introduction The guideline content section is structured to provide information on the following
key audit and assurance engagement topics:
2.1 Selection and use of criteria
2.2 Suitability
2.3 Acceptability
2.4 Source
2.5 Change in criteria during the audit engagement

2.1 Selection and 2.1.1 Professionals shall select criteria, against which the subject matter will be
Use of Criteria assessed. When selecting the criteria, professionals shall carefully consider

2014 ISACA All rights reserved. 2

IS Audit and Assurance Guideline 2008 Criteria
2.1 Selection and the suitability, acceptability and source of the criteria, as described in
Use of Criteria sections 2.2, 2.3 and 2.4, respectively.
cont. 2.1.2 Professionals should consider the selection of criteria carefully. Adhering to
local laws and regulations is important and should be considered a
mandatory requirement. However it is recognised that many audit
engagements include areas, such as change management, IT general
controls and access controls, not covered by law or regulations. In addition,
some industries, such as the payment card industry, have established
mandatory requirements. The relevance of local and international data
protection rules and privacy regulations should be considered. Where
legislative requirements are principle-based, professionals should ensure
that criteria selected meet the audit objective.
2.1.3 The use of suitable and acceptable criteria is required to ensure a consistent
evaluation of the subject matter. Without the right criteria, any conclusion
or opinion formed will be open for misunderstanding and interpretability
from a personal point of view by the reader.
2.1.4 Professionals should refrain from evaluating the subject matter on the basis
of their own expectations, experiences or judgements, because this would
not be considered as suitable and acceptable criteria.
2.1.5 Where criteria are not readily available, incomplete or subject to
interpretation, professionals should include a description and any other
information necessary to ensure that the report is fair, objective and
understandable, and the context in which the criteria are used is clear.
2.1.6 Professional judgement should be used in ensuring that the use of the
criteria will enable the development of a fair and objective opinion or
conclusion that will not mislead the reader or user. It is recognised that
management might put forth criteria that do not meet all of the
requirements.

2.2 Suitability 2.2.1 Professionals should assess the suitability and appropriateness of the criteria
used for assessing subject matter. The example criterion Local law stipulates
that all personal information of clients should always remain private when
conducting data transactions is used to clarify the following criteria
attributes:
ObjectivityFree from bias that may adversely impact professionals
findings and conclusions and, accordingly, may mislead the user of the
audit report, e.g., the criterion is objective because it is ratified by local
law
CompletenessSufficiently complete so that all criteria that could
affect professionals conclusions about the subject matter are
identified and used in the conduct of the audit engagement. Thus,
completeness of all criteria used should be achieved, given the
objectives of the audit engagement.
RelevanceRelevant to the subject matter and contribute to findings
and conclusions that meet the objectives of the audit engagement.
Criteria can be context-sensitive; even for the same subject matter
there can be different criteria depending on the objectives and
circumstances of the audit engagement, e.g., the criterion is considered

2014 ISACA All rights reserved. 3

IS Audit and Assurance Guideline 2008 Criteria
2.2 Sustainability relevant because data transactions are in scope of this audit
cont. engagement.
MeasurabilityPermit consistent measurement of the subject matter
and the development of consistent conclusions when applied by
different professionals in similar circumstances, e.g., the criterion is
measurable because every data transaction with unprotected personal
information can be uniquely identified and thus consistently measured
UnderstandabilityCommunicated clearly and not subject to significantly
different interpretations by intended users, e.g., the criterion is
understandable because this section of the law has already been the
subject of multiple court rulings, helping to establish a clear
understanding about the practical execution and interpretation of the law

2.3 Acceptability 2.3.1 The acceptability of criteria is affected by the availability of the criteria to
the users of the audit report, so that users understand the basis of the
assurance activity and the relevance of the findings and conclusions.
Sources may include those criteria that are:
RecognisedSufficiently well recognised so that their use is not
questioned by intended users
AuthoritativeReflect authoritative pronouncements within the area
and are appropriate for the subject matter, e.g., authoritative
pronouncements may come from professional bodies, industry groups,
government and regulators
Publicly availableIncludes standards developed by professional
accounting and audit bodies such as ISACA, International Federation of
Accountants (IFAC), and other recognised government, legal or
professional bodies
Available to all usersWhere not publicly available, criteria should be
communicated to all users through assertions that form part of the
audit report. Assertions consist of statements about the subject matter
that meet the requirements of suitable criteria so that they can be
audited, as described in Standard 1007 Assertions.
2.3.2 Professionals should ensure that the criteria used in an audit engagement
are either:
Externally acceptedRecognised, authoritative and publicly available
Externally confirmedCriteria developed by management (for a
specific audit engagement) are not considered recognised, authoritative
and publicly available. Before use, these criteria require external
validation by a recognised independent third party to ensure that
management does not implicitly enforce a wanted outcome of the audit
engagement.

2.4 Source 2.4.1 In addition to suitability and availability, the selection of IS assurance
criteria should also consider their source, in terms of their use and the
potential audience. For example, when dealing with government
regulations, criteria based on assertions developed from the legislation and
regulations that apply to the subject matter may be most appropriate. In

2014 ISACA All rights reserved. 4

IS Audit and Assurance Guideline 2008 Criteria
2.4 Source cont. other cases, industry or trade association criteria may be relevant. Possible
criteria sources, listed in order of consideration, are:
Criteria established by ISACAPublicly available criteria and standards
that have been exposed to peer review and a thorough due-diligence
process by recognised international experts in IT governance, control,
security and assurance.
Criteria established by other bodies of expertsSimilar to ISACA
standards and criteria, these are relevant to the subject matter and
have been developed and exposed to peer review and a thorough due-
diligence process by experts in various fields.
Criteria established by laws and regulationsWhile laws and
regulations can provide the basis of criteria, care must be taken in their
use. Frequently, wording is complex and carries a specific legal
meaning. In many cases, it may be necessary to restate the
requirements as assertions. Further, expressing an opinion on
legislation is usually restricted to members of the legal profession.
Criteria established by entities that did not follow due processThese
include relevant criteria developed by other entities that did not follow
due process and have not been subject to public consultation and
debate.
Criteria developed specifically for the audit engagementWhile
criteria developed specifically for the audit engagement may be
appropriate, take particular care to ensure that these criteria are
suitable, especially objective, complete and measurable. Criteria
developed specifically for an audit engagement are in the form of
assertions. They are usually developed to pertain to the needs of a
specific user. For example, various frameworks can be used as
established criteria for evaluating the effectiveness of the internal
control system; a certain user, however, may develop a set of criteria
that meets specific needs, e.g., a hierarchy of authorised approvals.
Professionals should clearly mention in the audit report that certain
criteria are developed specifically for the audit engagement. They
should consider if the developed criteria could mislead the intended
user and, if required, provide more information on the criteria.
Whereas these criteria were developed by management, external
confirmation should be sought and mentioned in the report, as
described in 2.3.2.

2.5 Change in 2.5.1 As the audit progresses, additional information and insight on the subject
Criteria During matter may result in a change of selected criteria:
the Audit Certain criteria might not be needed anymore to achieve the audit
Engagement
objective. In these circumstances, further audit work related to the
criteria is not necessary.
There might be a need for extra criteria to achieve the audit objective.
In these circumstances, extra criteria will be selected and audit work
related to the criteria will be conducted.

2014 ISACA All rights reserved. 5

IS Audit and Assurance Guideline 2008 Criteria

3. Linkage to Standards and COBIT 5 Processes

3.0 Introduction This section provides an overview of relevant:
3.1 Linkage to standards
3.2 Linkage to COBIT 5 processes
3.3 Other guidance

3.1 Linkage to The table provides an overview of:

Standards The most relevant ISACA standards that are directly supported by this guideline
Those standard statements that are most relevant to this guideline

Note: Only those standard statements relevant to this guideline are listed.

Standard Title Relevant Standard Statements

1007 Assertions IS audit and assurance professionals shall review the assertions
against which the subject matter will be assessed to determine
that such assertions are capable of being audited and that the
assertions are sufficient, valid and relevant.
1008 Criteria IS audit and assurance professionals shall select criteria, against
which the subject matter will be assessed, that are objective,
complete, relevant, measureable, understandable, widely
recognised, authoritative and understood by, or available to, all
readers and users of the report.

3.2 Linkage to The table provides an overview of the most relevant:

COBIT 5 COBIT 5 processes
Processes COBIT 5 process purpose

Specific activities performed as part of executing these processes are contained in

COBIT 5: Enabling Processes.

COBIT 5 Process Process Purpose

EDM01 Ensure governance Provide a consistent approach integrated and aligned with the
framework setting and enterprise governance approach. To ensure that IT-related
maintenance. decisions are made in line with the enterprises strategies and
objectives, ensure that IT-related processes are overseen
effectively and transparently, compliance with legal and
regulatory requirements is confirmed, and the governance
requirements for the board members are met.
MEA02 Monitor, evaluate and Obtain transparency for key stakeholders on the adequacy of the
assess the system of system of internal controls and thus provide trust in operations,
internal control. confidence in the achievement of enterprise objectives and an
adequate understanding of residual risk.

2014 ISACA All rights reserved. 6

IS Audit and Assurance Guideline 2008 Criteria

3.3 Other When implementing standards and guidelines, professionals are encouraged to
Guidance seek other guidance, when considered necessary. This could be from IS audit and
assurance:
Colleagues from within the organisation and/or outside the enterprise, e.g.,
through professional associations or professional social media groups
Management
Governance bodies within the organisation, e.g., audit committee
Other guidance (e.g., books, papers, other guidelines)

4. Terminology
Term Definition
Assertion Any formal declaration or set of declarations about the subject matter made by
management

Assertions should usually be in writing and commonly contain a list of specific

attributes about the specific subject matter or about a process involving the
subject matter.
Criteria The standards and benchmarks used to measure and present the subject matter
and against which an IS auditor evaluates the subject matter

Criteria should be:

ObjectiveFree from bias
CompleteInclude all relevant factors to reach a conclusion
RelevantRelate to the subject matter
MeasurableProvide for consistent measurement
Understandable

In an attestation engagement, benchmarks against which management's written

assertion on the subject matter can be evaluated. The practitioner forms a
conclusion concerning subject matter by referring to suitable criteria.
Professional The application of relevant knowledge and experience in making informed
judgement decisions about the courses of action that are appropriate in the circumstances of
the IS audit and assurance engagement
Subject matter The specific information subject to an IS auditors report and related procedures,
which can include things such as the design or operation of internal controls and
compliance with privacy practices or standards or specified laws and regulations
(area of activity).

5. Effective Date
5.1 Effective Date This revised guideline is effective for all IS audit and assurance engagements
beginning on or after 1 September 2014.

2014 ISACA All rights reserved. 7