Independence comes first

Exam

CISA

What it means

If the auditor designed, implemented or operated a control, they cannot objectively audit it. Answers that keep the auditor advising rather than deciding are the safe pattern.

The trap answer looks like

The auditor joins the project as a decision maker, designs the controls or signs off the system.

The winning answer looks like

The auditor advises on control requirements and leaves the decisions to the project team.

Worked example

An IS auditor is invited to approve design decisions on a new payments system. What is the main concern?

✅ The auditor's objectivity when later auditing that system

Advising is fine. Approving makes it the auditor's own work.