IS Standards, Guidelines and Procedures for Auditing and Control ...

G15 Planning continued2.5.1 Auditing projects should include consideration of internal controls either directly as a part of the auditing project objectives oras a basis for reliance upon information being gathered as a part of the auditing project. Where the objective is evaluation ofinternal controls the IS auditor should consider the extent to which it will be necessary to review such controls. When theobjective is to assess the effectiveness of controls over a period of time the audit plan should include procedures appropriatefor meeting the audit objectives, and these procedures should include compliance testing of controls. When the objective isnot to assess the effectiveness of controls over a period of time, but rather to identify control procedures at a point in time,compliance testing of controls may be excluded.2.5.2 When the IS auditor evaluates internal controls for the purpose of placing reliance on control procedures in support ofinformation being gathered as part of the audit, the IS auditor should ordinarily make a preliminary evaluation of the controlsand develop the audit plan on the basis of this evaluation. During a review, the IS auditor will consider the appropriateness ofthis evaluation in determining the extent to which controls can be relied upon during testing. For example, in using computerprograms to test data files, the IS auditor should evaluate controls over program libraries containing programs being used foraudit purposes to determine the extent to which the programs are protected from unauthorised modification.3. DOCUMENTATION3.1 Planning Documentation3.1.1 The IS auditor's workpapers should include the audit plan and the programme.3.1.2 The audit plan may be documented on paper or in another appropriate and retrievable form.3.2 Plan Endorsement3.2.1 To the extent appropriate, the audit plan, audit programme and any subsequent changes should be approved by the auditmanagement.3.3 Audit Programme3.3.1 A preliminary programme for a review should ordinarily be established by the IS auditor before the start of the work. This auditprogramme should be documented in a manner that will permit the IS auditor to record completion of the audit work andidentify work that remains to be done. As the work progresses, the IS auditor should evaluate the adequacy of the programmebased on information gathered during the audit. When the IS auditor determines that the planned procedures are notsufficient, the IS Auditor should modify the programme accordingly.3.3.2 Depending on the audit resources required, the IS auditor should include management of the personnel resources required inthe audit plan.3.3.3 The audit plan should be prepared so that it is in compliance with any appropriate external requirements in addition to ISAuditing Standards.3.3.4 In addition to a listing of the work to be done, the IS auditor should, to the extent practicable, prepare a list of personnel andother resources required to complete the work, a schedule for the work, and a budget.3.3.5 During the course of the work, the IS auditor should consider changes to the audit programme based on the IS auditor'sevaluation of the adequacy of the programme and the IS auditor's preliminary findings.4. EFFECTIVE DATE4.1 This guideline is effective for all information systems audits beginning on or after 1 March 2002.49