An IS auditor is assigned to audit a software development project which is more than 80 percent
complete, but has already overrun time by 10 percent and costs by 25 percent. Which of the
following actions should the IS auditor take?

A.
Report that the organization does not have effective project management.

B.
Recommend the project manager be changed.

C.
Review the IT governance structure.

D.
Review the conduct of the project and the business case.

Explanation:

Before making any recommendations, an IS auditor needs to understand the project and the
factors that have contributed to making the project over budget and over schedule. The
organization may have effective project management practices and sound ITgovernance and still
be behind schedule or over budget. There is no indication that the project manager should be
changed without looking into the reasons for the overrun.