An IS auditor is assigned to audit a software development project which is more than 80 percent
complete, but has already overrun time by 10 percent and costs by 25 percent. Which of the
following actions should the IS auditor take?

A.
Report that the organization does not have effective project management.

B.
Recommend the project manager be changed.

C.
Review the IT governance structure.

D.
Review the conduct of the project and the business case.

Explanation:
Before making any recommendations, an IS auditor needs to understand the project and the factors
that have contributed to making the project over budget and over schedule. The organization may
have effective project management practices and sound ITgovernance and still be behind schedule
or over budget. There is no indication that the project manager should be changed without looking
into the reasons for the overrun.