ISACA ITAF – IT Audit Framework

Why does it matter?

IT audit conclusions carry weight when the work follows a recognized professional standard. For CISA holders ITAF is that standard: ISACA's standards state the minimum level of acceptable performance required to meet the professional responsibilities in the ISACA Code of Professional Ethics, and failure to comply may lead to an investigation by the ISACA Board of Directors or a committee and, ultimately, disciplinary action.

Key benefits include:

• Mandatory standards with supporting guidelines

The standards define mandatory requirements, and the guidelines are designed to directly support them and help practitioners achieve alignment.

• One framework across engagement types

ITAF applies to IT-related, financial, compliance-related and operational audits and assessments (ISACA, October 2020).

• Public comment before change

Before issuing a new standard or guideline, or modifying an existing one, ISACA issues an exposure draft internationally for public comment.

• Current with technology

The 5th edition addresses cloud computing, AI/ML, business automation, data analytics, agile auditing, continuous assurance and AI governance.

• Free to adopt

ISACA publishes ITAF, 5th Edition, as a complimentary download.

How does it work?

Through the 4th edition, the standards are divided into three categories. General standards (1000 series) are the guiding principles for the profession: 1001 Audit Charter, 1002 Organizational Independence, 1003 Auditor Objectivity, 1004 Reasonable Expectation, 1005 Due Professional Care, 1006 Proficiency, 1007 Assertions and 1008 Criteria. Performance standards (1200 series) cover the conduct of the engagement: 1201 Risk Assessment in Planning, 1202 Audit Scheduling, 1203 Engagement Planning, 1204 Performance and Supervision, 1205 Evidence, 1206 Using the Work of Other Experts and 1207 Irregularities and Illegal Acts. Reporting standards (1400 series) are 1401 Reporting and 1402 Follow-up Activities.

Guidelines follow the same categories in the 2000, 2200 and 2400 series, with numbers that mirror the standards, for example 2201 Risk Assessment in Planning and 2402 Follow-up Activities. Tools and techniques add white papers, IT audit and assurance programs, reference books and the COBIT 2019 family of products. ISACA's 5th edition announcement describes updated terminology, examples and layout and does not list a change to this numbering; check the 5th edition for its current standard list.

ISACA's lead developer describes six shifts in the 5th edition: from isolated controls to digital ecosystems, from controls to trust, from periodic reviews to continuous insight, from sampling to data-driven testing, from an operational focus to governance and accountability, and from control function to strategic partner. The companion Performance Guidelines 2208: Information Technology Audit Sampling covers the design, selection and evaluation of audit samples to obtain sufficient and appropriate evidence.

Key Elements

• General standards (1001 to 1008)

Audit charter, organizational independence, auditor objectivity, reasonable expectation, due professional care, proficiency, assertions and criteria.

• Performance standards (1201 to 1207)

Risk assessment in planning, audit scheduling, engagement planning, performance and supervision, evidence, using the work of other experts, and irregularities and illegal acts.

• Reporting standards (1401 and 1402)

Reporting, covering the types of reports, means of communication and information communicated, and follow-up activities.

• Guidelines (2000, 2200 and 2400 series)

Guidance that supports each standard, with companion Performance Guidelines 2208 on IT audit sampling.

• Tools and techniques

White papers, IT audit and assurance programs, reference books and the COBIT 2019 family, plus ISACA's online glossary.

• Terms and concepts

Definitions specific to IT audit and assurance that give engagements a common vocabulary.

• 5th edition additions

Digital trust concepts across planning, fieldwork and reporting, AI/ML audit guidance, and wider coverage of analytics, agile auditing and continuous assurance.

What does it cover?

ITAF applies to any IT audit or assessment engagement, regardless of whether it is for an IT-related audit or one that is financial, compliance-related or operational, and ISACA describes it as highly relevant to CISA holders. Its standards cover how an engagement is chartered, planned, performed, supervised, reported and followed up, and the conduct and competence of the practitioner. Its guidelines are designed to directly support the standards, and its tools and techniques add further guidance.

What are its objectives?

ISACA states ITAF's purposes as three: standards for roles, responsibilities, ethics and skills; definitions of IT audit terms and concepts; and guidance and techniques for planning, performing and reporting. Its provisions pursue these outcomes:

Practitioners meet a defined minimum level of acceptable performance.

Engagements are planned from a risk assessment and scheduled (standards 1201 and 1202 in the 4th edition list).

Conclusions rest on sufficient and appropriate evidence, with sampling guidance (standard 1205 and Guidelines 2208).

Results are reported and followed up (standards 1401 and 1402).

Practice keeps pace with cloud, AI, automation and analytics (5th edition).

Framework in Context

ITAF is one of the ISACA frameworks, standards and models, alongside COBIT, which supplies tools and techniques, and the CISA certification, whose holders must follow the standards. The 4th edition of October 2020 updated the 2014 edition with more IT-specific guidance and examples, an emphasis on risk assessment in planning, more concise auditor objectivity content and a new format. ISACA's 2020 white paper An ITAF Approach to IT Audit Advisory Services addresses independence and objectivity when auditors also advise.

Common Framework Mappings

ITAF is commonly mapped to the governance and control frameworks its engagements assess against and to the audit and assurance standards it operates alongside. The mapped names are reference points for engagements, not content of ITAF itself.

Mapped frameworks include:

COBIT 2019

IIA Global Internal Audit Standards

ISO 27001:2022

NIST 800-53 Rev.5

NIST CSF 2.0

ITIL 4

ISAE 3000

SOC 2

SOX

PCAOB AS 2201