There is lots of legislation, regulations, and industry standards, with similar but not identical requirements and best practices.I think that IT auditors should choose one framework and always use that, but consider others for insights, such as industry-specific frameworks (e.g. HI-Trust for healthcare).  

Or would it be better to always use a combination of frameworks?

Answer rating: 100% (QA)

The decision of whether to use a single framework or a combination of frameworks in IT auditing depends on several factors including the organizations ... View the full answer