1 Why? The Auditor’s Mandate and Ethics
Why does Tessera need an audit, and why should they trust you?
🗂️ Tessera Case: The engagement opens
The email arrives on a Monday. Tessera’s CTO, racing toward an enterprise deal that requires ISO/IEC 27001 certification, has engaged your firm for a certification-readiness audit. The tone is confident: “We’re pretty much there, we just need the paperwork signed off.” That sentence records management’s expectation. It is not evidence that controls work or fail. Ask what assessment supports it, and keep both possibilities open. Your engagement opens with a question, not an answer: why does Tessera need this audit, and why should they trust the person delivering the opinion?
1.1 The auditor’s mandate
An auditor does not audit by accident. You audit because someone with the authority to ask for assurance has engaged you to provide it, on agreed terms, against agreed criteria. That is the mandate, and it has three parts that matter from day one.
You are engaged by a party that wants the opinion. In Tessera’s case, that is a board and a CTO chasing certification. You audit against criteria: a standard or framework that defines what “good” looks like, here ISO/IEC 27001:2022. And you deliver an opinion on whether the subject matter (Tessera’s information security management system) conforms to those criteria, supported by evidence you gathered on terms you set.
The mandate does not license you to poke around wherever you like, and it does not guarantee that you will find wrongdoing. It is a scoped, criteria-bound engagement whose entire value rests on one quality you bring to it: the credibility of the person giving the opinion. That credibility has a name, and it is the rest of this chapter.
1.2 Three hats: counsellor, partner, investigator
Auditors wear three hats, sometimes in the same meeting, and the skill is knowing which one the moment needs.
The counsellor helps the organisation understand its obligations before an opinion is formed. A client asks, “Do we really need separate incident-response and business-continuity plans?” You explain the standard, the intent, and the trade-offs. You are advising, not judging, and you must remember the difference, because advice given today shapes the evidence you evaluate tomorrow.
The partner works with the organisation to make the audit productive. You coordinate access, agree a realistic programme, and treat Tessera’s staff as people running a business, not suspects to be interrogated. Most audits fail on logistics, not on findings.
The investigator is the hat people picture: following the evidence where it leads, asking the uncomfortable question, refusing to accept “we do that” without proof. This is where professional scepticism lives, and it is the hat this book spends the most time on.
The three hats share one requirement: whichever you wear, your judgement has to be yours, and it has to be defensible. That brings us to the foundation the whole profession stands on.
1.3 Independence and objectivity
An audit opinion is only worth what the auditor’s independence is worth. If the opinion can be bought, pressured, or quietly shaped by self-interest, it is worthless, and everyone who relies on it is misled.
Independence is the fact of being free from relationships and interests that could compromise the opinion. Objectivity is the state of mind: the discipline to judge evidence on its merits, without bias, even when the answer is inconvenient. Independence is something an outsider can check; objectivity needs active safeguards and review throughout the engagement.
The profession catalogues the threats so you can spot them.
The dangerous threats are the ones that feel like normal business. A friendship with the CTO. A consulting contract that pays well and renews if the audit goes smoothly. A prior role inside the organisation. A desire to land next year’s engagement. None of these is a crime. Each of them is a pressure on the opinion, and each requires a safeguard, or a refusal of the engagement, before you begin.
The safeguards are familiar: rotate the engagement team, separate the audit from any consulting work, document the threats you identified and how you addressed them, and walk away when the threat cannot be reduced to an acceptable level. The discipline is not to pretend you have no interests. It is to be honest about them and act accordingly.
1.4 The ISACA Code of Ethics
Information security auditors work within a professional code. ISACA’s Code of Ethics is short and worth knowing by heart, because it is the standard your professional conduct will be measured against. Its obligations come down to a few commitments: support the organisation’s legitimate objectives while maintaining your independence; act with due care and competence; keep information confidential and protect privacy; and uphold the reputation of the profession.
Read it once and it sounds like generic good behaviour. Read it on the day a client asks you to soften a finding so a deal closes, and you find out what it actually costs. The code is not a poster. It is the answer you are expected to give when the pressure arrives, and the reason “no” is sometimes the only professional response.
1.5 Why would anyone invite an audit?
Step back to the question Tessera’s CTO has not fully asked: why pay someone to come and find your problems?
The honest answer is that an organisation invites an audit because the opinion is worth more than the cost to someone. For Tessera, certification unlocks enterprise customers whose procurement teams will not sign without it. For a board, an independent opinion is protection against the day something goes wrong: evidence that oversight was exercised, not neglected. For regulators, it is compliance made visible. And, less flatteringly but just as truly, organisations invite audits because the people inside them already suspect the gaps and want a credible outsider to name them.
The auditor’s job is to be worth that trust: to deliver an opinion that is genuinely independent, even when the organisation that paid for it hopes for a different answer. Tessera is paying you to find out whether they are ready.
1.6 Three kinds of control
Before the engagement goes further you need the vocabulary every audit uses. Controls (the safeguards an organisation puts in place to manage risk) come in three kinds, and knowing which kind you are looking at tells you what evidence will prove it works.
Preventive controls stop something going wrong. An access-review process that removes leavers’ accounts before they can be misused. A firewall rule. Mandatory training before a user gets privileges.
Detective controls notice that something has gone wrong, after the fact. A log that records a failed login. An alert when an admin account is created out of hours. A reconciliation that finds a discrepancy.
Corrective controls fix something once it is found. An incident-response plan. A backup you restore from. A patch you push out.
Most real defences are a chain of all three, because no single control is reliable on its own. A preventive control fails silently; you only find out it failed because a detective control caught it; you only recover because a corrective control exists. When you audit, you are testing the whole chain, and you are always asking the question that separates a control that exists from one that works.
🗂️ Tessera Case: Where Tessera’s hats show
From the outset of the engagement you wear all three hats at once. As counsellor, you explain the management-system requirements and how necessary controls are selected and justified. Annex A’s 93 controls are a reference set, not an undifferentiated mandatory checklist. As partner, you agree how the engagement will run and what access you will get (limited, for now). As investigator, you file away the CTO’s opening claim (“we’re basically ready”) as the first assertion the evidence will later confirm or refute. Every chapter from here tests that claim a different way.
An illustrative draft labels a scheduled access review “preventive because it stops former staff logging in.” The label depends on the mechanism. A periodic review detects inappropriate access; subsequent removal corrects it. An automatic disable at termination prevents later use of that credential. Write the mechanism and the evidence you would inspect before choosing a category. A model’s label, correct or otherwise, does not perform that analysis for you.
Independence is a fact and objectivity is a state of mind, and an AI has neither. It has no relationships to disclose, true, but it also has no stake, no accountability, and no capacity to refuse an engagement when a threat cannot be managed. More subtly, an AI trained on an organisation’s own data, or embedded in the tooling an organisation pays for, has interests of a new kind: commercial, algorithmic, and invisible.
So can an AI deliver an audit opinion? It can produce one. It cannot stand behind one, which is the entire point of an opinion. As AI-assisted controls and AI-generated evidence spread through the estates you audit, the question stops being theoretical. We return to it in Chapter 7, when we ask whether you can trust a log an AI produced.
Open your Evidence Locker with the engagement’s foundation. Record: the mandate (who engaged you, against what criteria, to deliver what opinion); the independence threats you identified for this engagement and the safeguards applied; and your one-line restatement of Tessera’s opening claim, the assertion the rest of the engagement will substantiate or refute. This is not note-taking. It is the first entry in a defensible audit trail.
1.7 From mandate to evidence
E01 in the fixed pack defines this as a readiness assessment. An internal audit evaluates the organisation’s own management system; a readiness assessment prepares for an external process; a certification body conducts its own audit and makes its own certification decision. Their roles and independence requirements cannot be treated as interchangeable.
Here is a first working paper. Criterion: P-IT requires full access revocation within 24 hours. Evidence requested: a dated termination record, all credential ownership records and disable events. Test: reconcile identities and recompute elapsed time. Possible conclusions: met for the tested record, exception, or insufficient evidence. A signed policy alone establishes none of those operating results.
1.8 Practice: accept the mandate?
Time: 15 minutes. No AI required. Read E01. Write a 150-word acceptance note naming the engagement type, subject, criteria, reporting limit and the analyst’s self-review threat. State a safeguard and the condition under which you would decline. Add it to milestone 1.
Check: your authority must stop short of certification and unauthorised production testing. A team change must prevent the analyst assessing their own integration; simply declaring the relationship is insufficient. Answer checks give the common standard for the locker.
The next chapter develops the risk priorities behind the programme.