ISC — Quick Sheet
IT Audit & Advisory Services
Read time: ~5 minutes
One-minute revision
- Scope top-down: process/objective → applications → ITGCs → automated controls and key reports
- IPE: system-generated reports must be tested for completeness and accuracy before reliance
- CAATs: test data, ITF, parallel simulation, embedded modules, generalized audit software
- Full-population testing removes sampling risk, not nonsampling risk — validate the extract
- Findings: condition, criteria, cause, effect, recommendation — tie to business impact