1.4Assurance-type and advisory-type audits

A systems audit is broadly divided into two types by its objective: an assurance-type audit (assurance engagement) in which the auditor expresses assurance (an opinion) that the audited target meets a certain standard, and an advisory-type audit (consulting engagement) in which problems are analyzed and improvements recommended to support the audited organization's improvement. This section develops not the rote memorization of both definitions, but the ability to discern whether the requester (management, etc.) truly wants "assurance that can be shown to a third party" or "practical advice for improvement," and to judge accordingly how to design the audit type, deliverable, and manner of maintaining independence.

1.4.1Assurance-type audit

• An assurance-type audit is one in which the auditor, from an independent position, verifies and expresses "assurance" (an opinion) that the audited target (an information system, its management, internal control, etc.) meets certain standards or requirements. The deliverable is an audit report containing the auditor's opinion, whose value lies in being something a third party (management, shareholders, business partners, etc.) can rely on and use.
• Because assurance is expressed, the auditor's independence and objectivity are required especially strictly. The opinion must be backed by sufficient and appropriate audit evidence, not the auditor's impression. A context that assures effectiveness to an external third party, as in a J-SOX internal-control audit, is a typical assurance type.

1.4.2Advisory-type (consulting) audit

• An advisory-type audit primarily aims to support improvement of the audited organization's information systems and management, analyzing problems and giving concrete recommendations (advice) for improvement. The deliverable is recommendations and improvement plans that contribute to improvement; expressing "assurance that a standard is met" to a third party is not the primary aim.
• Even in the advisory type, independence and objectivity are required, but there is a risk that if the auditor engages too deeply in improvement support, they later end up evaluating their own advice when auditing that improvement result in an assurance type, impairing independence. Thus one must clarify "is this advisory or assurance this time," and manage the impact on independence when the same person handles both in succession.

Suppose you are a systems auditor, and management requests, "for the newly introduced cloud platform, so that we can confidently show business partners and the parent company, please confirm that security management is appropriately established and operating." What matters here is that the objective behind the request's wording is "assurance that can be shown to a third party." Since they want to demonstrate effectiveness to external third parties—business partners and the parent company—this is a situation to design as an assurance-type audit, not an advisory type whose primary aim is recommendations. In an assurance type, because the auditor's opinion is relied upon and used by a third party, you must maintain independence and objectivity especially strictly and back the opinion with sufficient and appropriate audit evidence. If you had been deeply involved as an advisor in the design of this cloud platform's introduction, standing now in a position to assure its effectiveness would mean evaluating your own advice and lacking independence, so you should reconsider the assignment. On the other hand, if the request were "identify where the weaknesses are in operating the cloud platform, and think through the direction of improvement together," that is support for internal improvement rather than assurance to a third party—an advisory-type audit—and the deliverable would be recommendations rather than an assurance opinion. "First discern whether the requester wants assurance or advice, and design the audit type, deliverable, and strictness of independence accordingly"—this judgment is the key to not mistaking the entrance to the audit.

1.4.3Section summary

• An assurance-type audit expresses a degree of assurance (an opinion) to a third party, demanding especially strict independence and evidential backing
• An advisory-type (consulting) audit primarily aims at supporting and recommending the audited organization's improvement, with deliverables of recommendations and improvement plans
• First discern the requester's objective (assurance or advice) to judge the type, deliverable, and independence design, and when handling advisory then assurance in succession, manage the independence impact of evaluating one's own advice