PrepAway - Latest Free Exam Questions & Answers

what should the auditor do?

If an IS auditor observes that an IS department fails to use formal documented methodologies,
policies, and standards, what should the auditor do? Choose the BEST answer.

PrepAway - Latest Free Exam Questions & Answers

A.
Lack of IT documentation is not usually material to the controls tested in an IT audit.

B.
The auditor should at least document the informal standards and policies. Furthermore, the IS
auditor should create formal documented policies to be implemented.

C.
The auditor should at least document the informal standards and policies, and test for
compliance. Furthermore, the IS auditor should recommend to management that formal
documented policies be developed and implemented.

D.
The auditor should at least document the informal standards and policies, and test for
compliance. Furthermore, the IS auditor should create formal documented policies to be
implemented.

Explanation:
If an IS auditor observes that an IS department fails to use formal documented
methodologies, policies, and standards, the auditor should at least document the informal
standards and policies, and test for compliance. Furthermore, the IS auditor should recommend to
management that formal documented policies be developed and implemented.


Leave a Reply