While following up on a prior audit report, an IS auditor determines that a number of recommendations to address critical findings have not been implemented as agreed.
What is the BEST course of action for the auditor?
Click on the arrows to vote for the correct answer
A. B. C. D.C.
As an IS auditor, the best course of action to take when it is determined that recommendations to address critical findings have not been implemented as agreed is to escalate the issue to the appropriate level of management. Therefore, option C is the correct answer.
Explanation: Option A, reclassifying the risk ratings of the original findings, may be considered if new information has emerged that changes the nature or severity of the risks associated with the findings. However, in this scenario, the finding itself has not changed. It is only the fact that the recommendations to address it have not been implemented that has changed.
Option B, proposing revised implementation timelines, is also not the best course of action. While it may be appropriate to propose revised timelines if there is a legitimate reason why the original timeline cannot be met, in this scenario, the issue is not that the timeline was too short or unrealistic. It is that the agreed-upon timeline was not met.
Option D, revising the scope of the follow-up audit, is also not the best course of action. The scope of the follow-up audit should be based on the original findings, not on whether or not the recommendations to address them have been implemented. If the recommendations have not been implemented, it may be necessary to expand the scope of the audit to investigate why they were not implemented, but this should not be done at the expense of addressing the original findings.
Therefore, the best course of action is to escalate the issue to the appropriate level of management. This may involve notifying senior management or the audit committee, depending on the severity of the finding and the level of management responsible for implementing the recommendations. By escalating the issue, the auditor can ensure that appropriate action is taken to address the finding and that it does not continue to pose a risk to the organization.