A manager of a project was not able to implement all audit recommendations by the target date.
The IS auditor should:

A.
recommend that the project be halted until the issues are resolved.

B.
recommend that compensating controls be implemented.

C.
evaluate risks associated with the unresolved issues.

D.
recommend that the project manager reallocate test resources to resolve the issues.

Explanation:
It is important to evaluate what the exposure would be when audit recommendations have not been
completed by the target date. Based on the evaluation, management can accordingly consider
compensating controls, risk acceptance, etc. All other choicesmight be appropriate only after the
risks have been assessed.