During the audit of an acquired software package, an IS auditor learned that the software purchase was based
on information obtained through the Internet, rather than from responses to a request for proposal (RFP). The
IS auditor should FIRST:

A.
test the software for compatibility with existing hardware.

B.
perform a gap analysis.

C.
review the licensing policy.

D.
ensure that the procedure had been approved.

Explanation:
In the case of a deviation from the predefined procedures, an IS auditor should first ensure that the procedure
followed for acquiring the software is consistent with the business objectives and has been approved by the
appropriate authorities. The other choices are not the first actions an IS auditor should take. They are steps that
may or may not be taken after determining that the procedure used to acquire the software had been approved.