Exam CISA topic 1 question 1038 discussion

policies > standards > guardline > procedures

When assessing an organization's information systems and understanding management's approach to controls, the IS auditor should review policies FIRST. Policies provide the overarching framework and high-level guidance for establishing controls within an organization. They define the organization's intent, objectives, and expectations regarding information security and control measures. After reviewing policies, an auditor may then delve into more detailed documentation such as standards, guidelines, and procedures to understand how these policies are implemented and operationalized within the organization. Policies serve as the foundation for the development of more detailed control documentation.