While conducting an audit, an IS auditor detects the presence of a virus. What should be the IS
auditor’s next step?

A.
Observe the response mechanism.

B.
Clear the virus from the network.

C.
Inform appropriate personnel immediately.

D.
Ensure deletion of the virus.

Explanation:

The first thing an IS auditor should do after detecting the virus is to alert the organization to its
presence, then wait for their response. Choice A should be taken after choice C. This will enable
an IS auditor to examine the actual workability and effectiveness of the response system. An IS
auditor should not make changes to the system being audited, and ensuring the deletion of the
virus is a management responsibility.