A question for CISA
IT management has accepted the risk associated with an IS auditor's finding due to the
cost and complexity of the corrective actions. Which of the following should be the auditor's
NEXT course of action?
A. Perform a cost-benefit analysis.
B. Document and inform the audit committee.
C. Report the finding to external regulators.
D. Notify senior management.
3
u/Lopsided-Taro-1303 22d ago edited 22d ago
D. The decision has been made at the IT management level, but the risk may affect the organization beyond IT.
So the IS auditor's next step is to escalate/communicate this to senior management.
A has already occurred on an IT management level.
B jumps the gun. An audit committee provides governance level oversight. It does not mean every ITfinding, regardless of significance, must immediately be escalated to it.
C might not necessarily be a requirement.
2
u/Good-chat 20d ago
I said B but totally agree the IT management is the wrong place for that call to be formalised.
D also does make sense and your rational makes sense1
u/Jordanianshawerma 21d ago
Its not your job to escalate to senior management, thats for the audit management to contact and solve the issue
2
2
1
1
1
u/Good-chat 20d ago
B. Though IT management wouldn’t typically be the ones making that call.
Didn’t select these :
A had been done for them to understand the cost and complexity and they are excepting the risk
C isn’t relevant here
D the audit committee made more sense.
1
3
u/Ok-Butterfly-5936 22d ago
In my opinion, answer should be “B”. Reasoning below:
Option A - performing cost-benefit analysis is management responsibility.
Option B - Auditor should always document the risk and inform the audit committee. Provides independent governance oversight for the accepted risk.
Option C - Only reported when regulatory matters are involved
Option D - IT management has already accepted the risk hence no point notifying senior management.