The basic instrument used in the audit process is an Audit Terms of Reference (ATo R). In practice, we face problems in developing ATo Rs, namely that each IT auditor has his or her own way of developing them. The ATo R so developed consists of a mix of detailed & general rules concerning the control measures to be assessed.