Question

During an engagement, a junior IS auditor argues that an ISACA IT Audit Guideline should be applied exactly as written because 'it is required.' The audit manager reviews the situation and finds that following the guideline as written would not fit the specific technical environment being audited. According to ISACA's framework for IT audit and assurance, how should the manager characterize the applicability of ISACA Guidelines versus Standards?

Accepted Answer

Standards are mandatory requirements, while Guidelines provide guidance on how to apply the standards and allow professional judgment in their application

Answer

Both Standards and Guidelines are mandatory and must be applied without deviation in every engagement

Answer

Guidelines are mandatory requirements, while Standards are optional recommendations that may be tailored to the engagement

Answer

Neither Standards nor Guidelines are mandatory; both are advisory and compliance is at the auditor's discretion