Question 615 - CISA discussion

Substantive testing is the most important type of testing during software license audits, as it provides evidence of the accuracy and completeness of the software inventory and licensing records. Substantive testing involves examining transactions, balances, and other data to verify their validity, existence, accuracy, and valuation. Compliance testing, on the other hand, is more focused on assessing the adequacy and effectiveness of internal controls over software licensing, such as policies, procedures, and monitoring mechanisms. Compliance testing alone cannot provide sufficient assurance that the software license audit objectives are met, as it does not verify the actual software usage and compliance status. Judgmental sampling and stop-or-go sampling are methods of selecting samples for testing, not types of testing themselves.*Reference: According to the ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques for IS Audit and Assurance Professionals, section 1206 Testing, ''The IS audit and assurance professional should perform sufficient testing to obtain sufficient appropriate evidence to support conclusions reached.''1The section also defines substantive testing as ''testing performed to obtain audit evidence to detect material misstatements in transactions or balances'' and compliance testing as ''testing performed to obtain audit evidence on the operating effectiveness of controls.''1According to the ISACA IT Audit and Assurance Guideline G15 Software License Management, ''The objective of a software license audit is to provide management with an independent assessment relating to compliance with software license agreements.''2The guideline also states that ''substantive tests should be performed on a sample basis to verify that all software installed on devices within scope has been appropriately licensed.''2