Exam CISA topic 1 question 237 discussion

Recommendations are based on impact analysis. Root cause is used for incident management. I think the answer is correct

D, root cause. Recommendation should prevent recurrence of the issue.

Answer: D Root cause analysis enables auditors to address the underlying issues that contribute to findings, leading to more effective and sustainable improvements in the organization's processes or controls.

It is recommended that the plan be an improvement plan for the root causes of the identified issues.

MOST important factor for an IS auditor to determine and understand to develop meaningful recommendations for findings is the "criteria" or the standard or benchmark that serves as the basis for the audit. The criteria will provide a reference point for determining whether a finding is significant and requires remediation. Criteria may include industry standards, regulatory requirements, best practices, or company policies and procedures.

I agree D is a better answer. One would need to understand the root cause first in order to determine the impact.

it should be D.

I think it's D too. "Root cause analysis is the process of diagnosis to establish the origins of events (root causes). Once identified, the root causes can then be used to develop needed controls to accurately address these root causes that lead to system failures and deficiencies. Furthermore, root cause analysis also enables an organization to learn from consequences, typically from errors and problems, in the effort to not repeat undesired actions or results"

i think d