CISA: Certified Information Systems Auditor

Audit scope and control testing should be based on the documented risk assessment and planning rationale. Determining whether third-party access risk was identified in the planning documents establishes whether the omitted testing reflects an unaddressed risk or an intentional, risk-based scope decision.