Exam CISA topic 1 question 66 discussion

The first thing you need to do is review the policies and procedures because this may not even be a finding. If testing isn't required within that timeframe then nothing needs to be done.

The first thing you need to do is review the policies and procedures because this may not even be a finding. If testing isn't required within that timeframe then nothing needs to be done.

C. Review relevant system changes is the best next step because it helps the auditor determine whether any modifications have occurred in the systems or interfaces that could affect data integrity. If no changes have occurred since implementation, the risk may be lower. If changes have been made, the lack of re-testing becomes a more serious control gap. Comparisons: A. Review previous system interface testing records – Useful to establish a baseline, but not sufficient on its own. You still need to assess what has changed since that time. B. Document the finding in the audit report – This may be appropriate eventually, but the auditor needs to gather more context (such as system changes) before determining the risk and significance of the finding. D. Review IT testing policies and procedures – Helps understand expected practices, but it doesn’t assess the actual risk posed by the current situation.

Answer: C Reviewing system changes can reveal if there have been updates, modifications, or integrations that could affect data integrity.

Answer: C

D is about testing

Policies should identify rules for how often IT testing should be performed.

It says automated control, therefore, it would be performing correctly since the last test if there has been no changes to the application.

What does the policy say first? That would determine the other options listed.

Confirm what the Policy states for the testing timeframe.

its definitely not A. I think it must be D.

C is completely WRONG. As an IS auditor, you’d want to check their policies and procedures to see what they have documented as a standard review timeframe.

d is answer

The answer is correct, Review the changes

C Review the changes, still include the finding in the audit report.

The next step the IS auditor should take in this scenario is to review previous system interface testing records. This will provide the auditor with information about how the system interfaces were tested during the implementation two years ago and whether any issues were identified at that time. It will also help the auditor determine if any changes have been made to the system interfaces since the previous testing.

Why not D. Am confused.