During a human resources (HR) audit, an IS auditor is informed that there is a verbal agreement between the IT and HR departments as to the level of IT services expected. In this situation, what should the IS auditor do FIRST?
Postpone the audit until the agreement is documented
Report the existence of the undocumented agreement to senior management
Confirm the content of the agreement with both departments
Draft a service level agreement (SLA) for the two departments
An IS auditor should first confirm and understand the current practice before making any recommendations. The agreement can be documented after it has been established that there is an agreement in place. The fact that there is not a written agreement does not justify postponing the audit, and reporting to senior management is not necessary at this stage of the audit. Drafting a service level agreement ( SLA ) is not the IS auditor’s responsibility.