Isaca Certified Information Systems Auditor CISA Question # 352 Topic 36 Discussion
CISA Exam Topic 36 Question 352 Discussion:
Question #: 352
Topic #: 36
During the discussion of a draft audit report IT management provided suitable evidence that a process has been implemented for a control that had been concluded by the IS auditor as ineffective Which of the following is the auditor ' s BEST action?
A.
Explain to IT management that the new control will be evaluated during follow-up
B.
Add comments about the action taken by IT management in the report
C.
Change the conclusion based on evidence provided by IT management
D.
Re-perform the audit before changing the conclusion
The auditor’s best action is to re-perform the audit before changing the conclusion, because the auditor needs to obtain sufficient and appropriate evidence to support the audit opinion. The evidence provided by IT management may not be reliable or relevant, and it may not reflect the actual effectiveness of the control during the audit period. Therefore, the auditor should verify the evidence independently and test the control again to ensure that it meets the audit criteria and objectives. The other options are not appropriate, because they either ignore or accept the evidence provided by IT management without verification, which may compromise the quality and integrity of the audit. References:
ISACA, IT Audit and Assurance Standards,Guidelines and Tools and Techniques for IS Audit and Assurance Professionals, section 12062
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit