Standards for Information Systems Control Professionals

  Download this Document in PDF (18k)

510. Statement of Scope

510.010 Responsibility, Authority and Accountability
The responsibility, authority and accountability of the information systems control functions are to be appropriately documented and approved by an appropriate level of management.

520. Independence

520.010 Professional Independence
In all matters related to information systems control, the information systems control professional is to be independent in attitude and appearance.

520.020 Organisational Relationship
The information systems control function is to be sufficiently independent of the area being controlled to permit objective completion of the information systems control professional's duties.

530. Professional Ethics and Standards

530.010 Code of Professional Ethics
The information systems control professional is to adhere to the Code of Professional Ethics issued by ISACA®.

530.020 Due Professional Care
Due professional care and observance of applicable professional standards are to be exercised in all aspects of the information systems control professional's work.

540. Competence

540.010 Skills and Knowledge
The information systems control professional is to be technically competent, having the skills and knowledge necessary to perform the control professional's work.

540.020 Continuing Professional Education
The information systems control professional is to maintain competence through appropriate continuing professional education.

550. Planning

550.010 Control Planning
The information systems control professional is to use risk assessment and other tools as appropriate in planning and prioritising the information systems control work to address the control objectives.

560. Performance of Work

560.010 Supervision
Information systems control professionals are to be appropriately supervised and coordinated to provide assurance that control objectives are accomplished and applicable professional standards are met.

560.020 Evidence
The information systems control professional is to maintain sufficient, reliable, relevant and useful evidence of activities and tasks performed to achieve the control objectives. Control assessments are to be supported by appropriate analysis and interpretation of this evidence.

560.030 Effectiveness
In carrying out their duties, information systems control professionals are to establish appropriate measures of the effectiveness of their activities in achieving both the objectives of their role and the objectives defined in the Statement of Scope.

570. Reporting

570.010 Periodic Reporting
The information systems control professional is to report periodically to an appropriate level of management on the extent to which control objectives have been achieved.

580. Follow-Up Activities

580.010 Follow-Up
The information systems control professional is to monitor the performance of control procedures and review feedback on the efficiency and effectiveness of control activities and is to ensure appropriate corrective action is taken where necessary.

This material was issued on 1 May 1999 and is effective for information systems control activities carried out on or after 1 September 1999.