Exam CISA topic 1 question 1045 discussion

The IS auditor's BEST course of action is to document management's reasons for not addressing deficiencies. This documentation is important for several reasons: Transparency: Documenting management's reasons provides transparency and clarity about the issues that have not been addressed. Communication: It facilitates communication between the auditor and management, helping to understand the rationale behind the decision not to address certain deficiencies. Audit Trail: It creates an audit trail, demonstrating that the auditor has followed up on the identified deficiencies and has documented the responses from management.

D. assess the impact of not addressing deficiencies. In this situation, the IS auditor's best course of action is to assess the impact of not addressing the critical deficiencies. This assessment will help in understanding the potential risks and consequences of not addressing these issues and can provide valuable information to management for decision-making. It may also lead to documenting management's reasons for not addressing the deficiencies and potentially providing new recommendations based on the assessment findings. Postponing the audit may not be the most practical option, as it may not necessarily prompt immediate action on the deficiencies.