The IS audit standard for proficiency states that the IS auditor must have the knowledge, skills and experience needed to perform the audit work. This implies that the IS auditor must be competent in both the technical and business aspects of the audit subject matter. Therefore, team member assignments must be based on individual competencies, so that each auditor can perform the tasks that match their qualifications and expertise. This will also ensure that the audit objectives are met and the audit quality is maintained.
Option B is incorrect because technical co-sourcing is not a requirement to meet the IS audit standard for proficiency. Co-sourcing is an option that may be used when the internal audit function lacks the necessary resources or skills to perform the audit work. However, co-sourcing does not guarantee that the new staff will acquire the proficiency needed for the audit. Moreover, co-sourcing may introduce additional risks and challenges, such as confidentiality, independence, communication and coordination issues.
Option C is incorrect because having a globally recognized audit certification does not necessarily mean that the standard for proficiency is met. A certification is an indication of the auditor’s knowledge and competence in a specific domain, but it does not cover all aspects of IS auditing. The auditor must also have relevant experience and continuous learning to maintain and enhance their proficiency. Furthermore, having one certified member does not ensure that the other members are also proficient.
Option D is incorrect because having a supervisor review the new auditors’ work is not sufficient to meet the IS audit standard for proficiency. A supervisor review is a quality assurance measure that helps to ensure that the audit work is performed in accordance with the standards and policies.However, a supervisor review does not substitute for the proficiency of the auditors who perform the work. The auditors must still have the necessary knowledge, skills and experience to conduct the audit tasks effectively and efficiently.
References:
CISA Online Review Course1, Module 1: The Process of Auditing Information Systems, Lesson 2: Mandatory Guidance, slide 8-9.
CISA Review Manual (Digital Version)2, Chapter 1: The Process of Auditing Information Systems, Section 1.3: Mandatory Guidance, p. 24-25.
CISA Review Manual (Print Version), Chapter 1: The Process of Auditing Information Systems, Section 1.3: Mandatory Guidance, p. 24-25.
CISA Questions, Answers & Explanations Database3, Question ID: QAE_CISA_711.
