Exam CISA topic 1 question 596 discussion

When assessing a newly implemented call center, the IS auditor’s first step should be to evaluate the operational risks, because: This sets the foundation for identifying key areas that require control testing. It helps the auditor prioritize risks related to availability, confidentiality, integrity, and compliance. Risk evaluation drives a risk-based audit approach, which is the standard recommended by ISACA and professional audit practices.

since question stated the word FIRST, not the MOST IMPORTANT, the answer is C. Auditor will first need to review manuals, documentations and controls implemented then can be evaluating the risk associated https://www.examtopics.com/discussions/isaca/view/126715-exam-cisa-topic-1-question-596-discussion/#with operations or other implemented controls

Option D, "Assess the operational risks associated with the call center," is also important, but risk assessment is usually considered a process that takes place after a control check. By checking controls first, the accuracy and effectiveness of risk assessment will be improved.

D. evaluate the operational risk associated with the call center.

Why not C?

Before gathering information from customers or conducting technical tests, it's important for the auditor to have a clear understanding of the internal controls that are in place. This includes both manual and automated controls that govern the operations of the call center. By reviewing these controls first, the auditor can identify potential weaknesses, gaps, or areas of concern that may need further investigation or testing.