Quality Assurance of Audit Processes

QA is a process that ensures that audits follow established standards and best practices, giving stakeholders confidence in the audit results. It is crucial for making sure that audits are reliable and effective. The QA process includes supervision by the audit committee, continuous education for IS auditors, and performance monitoring of the IS audit function. These controls are discussed next.

Oversight by Audit Committee

The audit committee, usually made up of members of the board of directors, plays a vital role in ensuring the quality of the audit process by overseeing the audit function to make sure audits are done fairly and thoroughly. The audit committee approves the audit plan, reviews audit reports, and ensures that any issues found are addressed properly. Their oversight helps maintain the independence and objectivity of the audits, which is essential for high-quality results.

Continuous Education and Updating of IS Auditors

In the fast-changing field of IS, it is essential for IS auditors to keep their knowledge and skills up to date. This involves staying informed about the latest technology developments, regulatory changes, and new risks. IS auditors should participate in training programs, earn certifications, and attend industry conferences to maintain their expertise. Continuous education helps auditors effectively identify and assess risks, use advanced audit techniques, and provide valuable insights to their organization.

Performance Monitoring of IS Audit Functions

Monitoring the performance of the IS audit function is a key part of QA as it ensures that audits are effective and meet their objectives. It also provides a feedback loop for continuous improvement, allowing the audit function to adapt and remain relevant in a changing environment. Here are some examples of key performance indicators (KPIs) that can be used to monitor and evaluate the performance of the IS audit function:

• Audit coverage rate: This is the percentage of planned audits that were completed within a given period. It is calculated as follows: Number of completed audits / Number of planned audits × 100.
• Audit finding closure rate: This is the percentage of identified audit findings that have been addressed and closed within the specified timeframe. It is calculated as follows: Number of closed audit findings / Number of total audit findings × 100.
• Timeliness of audit reports: This is the average time taken to issue audit reports after the completion of an audit. It is calculated as the average number of days from audit completion to report issuance.
• Audit recommendation implementation rate: This is the percentage of audit recommendations that have been implemented by management. It is calculated as follows, using an example KPI: Number of implemented recommendations / Number of total recommendations × 100.
• Resource utilization: This is the extent to which audit resources (e.g., personnel or budget) are utilized effectively. It is calculated as follows, using an example KPI: Actual hours spent on audits / Budgeted hours for audits × 100.
• Stakeholder satisfaction: This is the level of satisfaction among stakeholders (e.g., audit committee and management) with the audit process and outcomes. An example KPI would be the average satisfaction rating from stakeholder surveys.
• Compliance rate: This is the percentage of audits that comply with established internal audit standards and procedures. It is calculated as follows: Number of compliant audits / Number of total audits × 100.
• Risk coverage: This is the extent to which critical risks are identified and addressed through the audit process. It is calculated as follows: Number of critical risks audited / Number of critical risks identified × 100.
• Training and development: This is the investment in and effectiveness of training and development programs for audit staff. It is calculated as the average training hours per auditor per year.
• Audit cost efficiency: This is the cost-effectiveness of the audit function in relation to the value it provides. It is calculated as follows: Total audit cost / Number of audits conducted.

By regularly tracking these KPIs, the IS audit function can ensure continuous improvement, demonstrate its value to the organization, and align its activities with the business objectives.

Continuous Improvement

In addition to the preceding points, the IS audit function should also focus on continuous improvement and adaptation. This involves staying updated with the latest trends and threats in the IT landscape, regularly updating audit methodologies, and incorporating feedback from previous audits. It also includes fostering a culture of collaboration between the IS audit team and other departments to ensure a holistic approach to risk management and compliance.

Accreditation/Certification of the IS Audit Function

Accreditation or certification of the IS audit function provides formal recognition that the audit process meets established standards. This can enhance the credibility and reliability of the audit function. For example, ISO 9001 QMS helps in standardizing the processes within the IS audit function. This standardization ensures that all audits are conducted in a consistent manner, following predefined procedures and guidelines. By having a clear set of standards and procedures, IS auditors can perform their tasks more effectively and efficiently, reducing variability and improving the reliability of audit outcomes. Such accreditations not only boost stakeholder confidence but also ensure that the audit function remains aligned with industry standards and practices.

By implementing strong QA measures, organizations can ensure that their audit processes are compliant with standards and contribute effectively to overall governance and risk management.

Key Aspects for the CISA Exam

The following table covers the important aspects from the CISA exam perspective:

Questions	Possible Answers
Why is continuous education important for IS auditors?	To address emerging risks
What is the most important factor in ensuring the success of a new audit QA program?	Commitment and support from executive management
What is the primary objective of a QA and improvement program for an audit process?	To design a structured framework for improving audit effectiveness
What is the most important factor to demonstrate the success of the QA program?	KPIs are continuously improved

Table 2.17: Key aspects for the CISA exam