Proper planning is fundamental for a successful audit. The Audit Charter contains the output from the planning exercise and describes the scope, objectives, approach, timeline, roles, and responsibilities for the audit.

Internal audits are approved by senior management, and external audits are a central element of the contract for the audit service.

CISA promotes a risk-based approach to audit planning, which means the risks to the business of using IS are identified and the control framework then reviewed to determine if appropriate risk controls are in place. An understanding of these risks and controls is how the audit scope is developed.

The information systems (IS) auditing process encompasses the standards, principles, methods, guidelines, practices and techniques that an IS auditor uses to plan, execute, assess and review business or information systems and related processe