The guideline is presented in the following sections:
- Guideline purpose and linkage to standards
- Guideline content
- Linkage to standards and COBIT 5 processes
- Effective date
1. Guideline Purpose and Linkage to Standards
This section clarifies the:
1.1 Purpose of the guideline
1.2 Linkage to standards
1.3 Term usage of ‘audit function’ and ‘professionals’
1.1.1 The purpose of this guideline is to assist IS audit and assurance professionals in preparing an audit charter. The audit charter defines the purpose, responsibility, authority and accountability of the IS audit and assurance function.
1.1.2 IS audit and assurance professionals should consider this guideline when determining how to implement the standard, use professional judgement in its application, be prepared to justify any departure and seek additional guidance if considered necessary.
1.2 Linkage to Standards
1.2.1 Standard 1001 Audit Charter
1.2.2 Standard 1002 Organisational Independence
1.2.3 Standard 1003 Professional Independence
1.3 Term Usage
- ‘IS audit and assurance function’ is referred to as ‘audit function’
- ‘IS audit and assurance professionals’ are referred to as ‘professionals’
2. Guideline Content
The guideline content section is structured to provide information on the following key IS audit and assurance engagement topics:
2.2 Contents of audit charter
2.1.1 Professionals should have a clear mandate to perform the audit function. This mandate is normally documented in an audit charter that should be formally approved by those charged with governance, e.g., board of directors and audit committee. Where an audit charter exists for the audit function as a whole, the IS audit and assurance mandate should be incorporated.
2.2 Contents of Audit Charter
2.2.1 The audit charter should clearly address the four aspects of purpose, responsibility, authority and accountability. These aspects are set out in the following sections.
2.2.2 Purpose of the audit charter and audit function should contain the following sections:
2.2.3 Responsibility of the audit function should contain the following sections:
- Aims/goals of the audit charter provide a functional and organisational framework in which the audit function operates.
- Mission statement and objectives of the audit function bring a structured approach to evaluate and improve the design and operational effectiveness of the risk management processes, internal control system and governance structures of information systems.
- Scope of the audit function is for either the entire enterprise or a specific organisation within the enterprise.
- Governance details the authorising body for the audit charter and audit function.
2.2.4 Authority of the audit function should contain the following sections:
- Operating principles provide a more detailed and quantitative enumeration of the different objectives of the audit function.
- Independence details the implementation of the independence requirement for the audit function and professionals, as described in Standards 1002 Organisational Independence and 1003 Professional Independence.
- Relationship with external audit details the relationship of the audit function with the external auditor:
- Meeting with the external auditors to coordinate the work effort to minimise duplication efforts
- Providing access to the professionals’ working papers, documentation and evidence
- Taking into account the planned work by the external auditors when drafting the audit plan for the coming period
- Auditee expectations details the services and deliverables the auditees can expect from the audit function and professionals:
- Description of identified problems, consequences and possible resolutions relating to the area of responsibility of the auditee
- Possibility to include management response and corrective actions taken on findings in the audit report. This includes references to related service level agreements (SLAs) for items such as delivery of reports, response to auditee complaints, quality of service, review of performance, reporting process and agreement of findings.
- Auditee requirements detail the responsibilities of the auditee, e.g., all auditees are required to make themselves available and assist the audit function and professionals in fulfilling assigned responsibilities.
- Communication with auditees details the frequency and communication channels through which the audit function will communicate with the auditees.
2.2.5 Accountability of the audit function should contain the following sections:
- Right of access to relevant information, systems, personnel and locations by professionals when performing an audit engagement. The audit function, represented by professionals:
- Is authorised, full, free and unrestricted access to any and all records, documentation, systems and locations when performing an audit engagement and can seek assistance from executive management in obtaining this access
- Has the authority to seek any information from an employee, consultant or contractor when performing an audit engagement
- Limitations of authority of the audit function and professionals, if any
- Processes to be audited, which the audit function is authorised to audit, e.g., the audit function is free to determine the processes it will audit, based on the risk-based audit plan
2.2.6 Other aspects that should be considered to add in the audit charter are:
- Organisational structure, including reporting lines to board and senior management, of the audit function, e.g., the audit function should have open and unrestricted access to the board and its members
- Reporting that details the format, content and recipients of the communication on the outcome of every audit engagement, e.g., a written audit report will be issued by the audit function after every audit engagement and distributed to the appropriate stakeholders, including scope, actions performed, findings, recommendations, management’s response and corrective actions taken
- Performance of the audit function that details the periodic reporting process to the board on the performance of the audit function compared to the audit plan and budget, e.g., the audit function will report every quarter to the board on its purpose, responsibility and authority, as well as performance relative to the audit plan and budget
- Compliance with standards that details the standards with which the audit function and professionals will adhere, e.g., the audit function and professionals will adhere and act according to all the ISACA IS Audit and Assurance Standards and Guidelines
- Quality assurance process (e.g., interviews, customer satisfaction surveys, assignment performance surveys) that establishes an understanding of auditees’ needs and expectations relevant to the audit function. These needs should be evaluated against the audit charter with a view to improving the service or changing the service delivery or audit charter, as necessary. Independent external quality reviews enable the audit function to assess its compliance with applicable standards, the enterprise’s risk and control framework, optimal use of resources and use of good practices. An independent external quality review of the audit function should be performed at least every five years to maintain conformance with the ISACA IS Audit and Assurance Standards.
- Staffing rules for audit engagements, e.g., establishing a minimum time period before which professionals will not be staffed on audit engagements in areas where they performed non-audit services that impair independence. The audit charter should also establish whether professionals are permitted to be involved in performing non-audit services and the broad nature, timing and extent of such services, to ensure that independence is not impaired. This could eliminate or minimise the need to obtain specific mandates for each non-audit service on a case-by-case basis.
- Continuous education commitment of the audit function toward the professionals, e.g., the audit function commits itself to provide professionals with a minimum of 40 hours of training per year
- Agreed actions regarding the audit function’s and professionals’ behaviour, e.g., penalties when either party fails to carry out its responsibilities
- Reviewing and amending the charter, which is the responsibility of the audit function. It should periodically assess whether the purpose, responsibility, authority and accountability, as defined in the audit charter, continue to be adequate and communicate the result of the assessment to the audit committee.
- Obtaining approval of amendments to the audit charter from those charged with governance.
- Including related documents such as referencing related standards, guidelines, policies, frameworks, manuals, etc.
3. Linkage to Standards and COBIT 5 Processes
This section provides an overview of relevant:
3.1 Linkage to standards
3.2 Linkage to COBIT 5 processes
3.3 Other guidance
3.1 Linkage to Standards
The table provides an overview of:
- The most relevant ISACA IS audit and assurance standards that are directly supported by this guideline
- Those standard statements that are most relevant to this guideline
Note: Only those standard statements relevant to this guideline are listed.
Relevant Standard Statements
|1001 Audit Charter
||The IS audit and assurance function shall document the audit function appropriately in an audit charter, indicating purpose, responsibility, authority and accountability. The IS audit and assurance function shall have the audit charter agreed upon and approved at an appropriate level within the enterprise.|
|1002 Organisational Independence
||The IS audit and assurance function shall be independent of the area or activity being reviewed to permit objective completion of the audit and assurance engagement.|
|1003 Professional Independence
||IS audit and assurance professionals shall be independent and objective in both attitude and appearance in all matters related to audit and assurance engagements.|
3.2 Linkage to COBIT 5 Processes
The table provides an overview of the most relevant:
- COBIT 5 process
- COBIT 5 process purpose
Specific activities performed as part of executing these processes are contained in COBIT 5: Enabling Processes.
COBIT 5 Process
|MEA02 Monitor, evaluate and assess the system of internal controls.
||Obtain transparency for key stakeholders on the adequacy of the system of internal controls and, thus, provide trust in operations, confidence in the achievement of enterprise objectives and an adequate understanding of residual risk.|
3.3 Other Guidance
When implementing standards and guidelines, professionals are encouraged to seek other guidance when considered necessary. This could be from IS audit and assurance:
- Colleagues from within the enterprise
- Governance bodies within the enterprise, e.g., audit committee
- Professional organisations
- Other professional guidance (e.g., books, papers, other guidelines)
A document approved by those charged with governance that defines the purpose, authority and responsibility of the internal IS audit and assurance activityThe charter should:
- Establish the internal IS audit and assurance function’s position within the enterprise
- Authorise access to records, personnel and physical properties relevant to the performance of IS audit and assurance engagements
- Define the scope of the IS audit and assurance function’s activities
A specific audit assignment, task or review activity, such as an audit, control self-assessment review, fraud examination or consultancy.
An audit engagement may include multiple tasks or activities designed to accomplish a specific set of related objectives.
||The freedom from conditions that threaten objectivity or the appearance of objectivity. Such threats to objectivity must be managed at the individual auditor, engagement, functional and organisational levels. Independence includes independence of mind and independence in appearance.|
5. Effective Date
5.1 Effective Date
This revised guideline is effective for all IS audit and assurance engagements beginning on or after 1 September 2014.