While conducting an audit, an IS auditor detects the presence of a virus. What should be the IS auditor’s next
step?

A.
Observe the response mechanism.

B.
Clear the virus from the network.

C.
Inform appropriate personnel immediately.

D.
Ensure deletion of the virus.

Explanation:
The first thing an IS auditor should do after detecting the virus is to alert the organization to its presence, then
wait for their response. Choice A should be taken after choice C. This will enable an IS auditor to examine the
actual workability and effectiveness of the response system. An IS auditor should not make changes to the
system being audited, and ensuring the deletion of the virus is a management responsibility.