When preparing an audit report the IS auditor should ensure that the results are supported by:

A.
statements from IS management.

B.
workpapers of other auditors.

C.
an organizational control self-assessment.

D.
sufficient and appropriate audit evidence.

Explanation:

ISACA’s standard on ‘reporting’ requires the IS auditor have sufficient and appropriate audit
evidence to support the reported results. Statements from IS management provide a basis for
obtaining concurrence on matters that cannot be verified with empirical evidence. The report
should be based on evidence collected during the course of the review even though the auditor
may have access to the work papers of other auditors. The results of an organizational control
self-assessment (CSA) could supplement the audit findings. Choices A, B and C might be
referenced during an audit but, of themselves, would not be considered a sufficient basis for
issuing a report.