IS Audit Standards, Guidelines, Functions, and Codes of Ethics form the mandatory governance framework that defines HOW an IS auditor must conduct their work — not just what they audit. ISACA's IS Audit Standards (IAS) are 14 mandatory principles organized across audit charter establishment (IAS 1010), evidence collection (IAS 1130), planning (IAS 1200), execution (IAS 1300 series), and reporting (IAS 1400 series). IS Audit Guidelines are advisory interpretations of those standards — expected best practices, but not mandates. The Code of Professional Ethics establishes four enforceable principles binding all CISA holders: Integrity, Objectivity, Confidentiality, and Competency. Together, these elements define the IS audit function — its scope, independence requirements, reporting obligations, and the behavioral constraints on every auditor exercising professional judgment.
Where it stops · what it isn't
- —IS Audit Standards govern audit process and auditor conduct — they do not define what controls an organization must have (that is the domain of COBIT, NIST, ISO 27001).
- —IS Audit Guidelines are advisory best practices — deviation is permitted if a defensible alternative approach is documented; deviation alone is not a standards violation.
- —The Code of Professional Ethics applies to CISA-certified individuals and ISACA members — it is not a legal statute enforceable by courts, though violations can constitute evidence of negligence in litigation.
- —IAS are not the same as regulatory audit requirements (HIPAA, SOX, PCI-DSS) — IAS govern how auditors operate within those regulatory contexts, not the controls those regulations require.
- —The IS audit function (internal or external) is not the same as a cybersecurity team, compliance team, or IT operations team — auditors must maintain independence from the functions they audit.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFIS Auditing Process (CISA Domain 1)
REQUIRESAudit Charter (IAS 1010)Audit Independence and Objectivity
ENABLESAudit Planning (IAS 1200)Audit Evidence Collection (IAS 1130)Audit Reporting and Follow-Up (IAS 1400 series)
RELATED TOAudit Tools, Techniques, and Methods (CISA Domain 1)
CONSTRAINSRisk-Based Audit PlanningAuditor Conduct and Ethical Decision-Making