An IS auditor is assigned to audit a software development project which is more than 80 percent complete, but
has already overrun time by 10 percent and costs by 25 percent. Which of the following actions should the IS
auditor take?

A.
Report that the organization does not have effective project management.

B.
Recommend the project manager be changed.

C.
Review the IT governance structure.

D.
Review the conduct of the project and the business case.

Explanation:
Before making any recommendations, an IS auditor needs to understand the project and the factors that have
contributed to making the project over budget and over schedule. The organization may have effective project
management practices and sound ITgovernance and still be behind schedule or over budget. There is no
indication that the project manager should be changed without looking into the reasons for the overrun.