An employee approaches an IS auditor and expresses concern about a critical security issue in a newly installed application. Which of the following would be the MOST appropriate action for the auditor to take?
A.
Discuss the concern with audit management
B.
Recommend reverting to the previous application.
C.
Immediately conduct a review of the application.
The word "immediately" is pretty strong, but there is nothing forbidding to conduct a review of the application.
Having say that, my review would probably start by gathering feedback from other end-users.
I love the way ISACA phrase their questions ...
A conversation with your audit manager can help you clarify next steps to determine appropriate investigations and responses, and assess the severity of the issue. This approach is also important for formally recording the issue and engaging with other parties as needed.
When an individual user approaches an auditor, their response should always be coordinated with their audit management. Therefore A. It happens again and again that individual users try to instrumentalize auditors for their own interests. For example, if a user would have preferred a different solution and feels ignored and now wants to take revenge for their choice. As a result of the coordination with the audit management, option B., C. or D. may well emerge as a follow-up action.
Instead of making a decision based on a complaint from one user, it is better to verify if other users are also experiencing the same issue. D makes sense
Why it isn't C? is it because the auditor might have other commitments? Wouldn't checking with more end users make more people to be aware of the security risk which may be exploited by any disgruntled employee?
upvoted 2 times
...
This section is not available anymore. Please use the main Exam Page.CISA Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
oldmagic
Highly Voted 2 years, 1 month agoChaBum
1 year, 5 months agoSwallows
Most Recent 1 year ago46080f2
1 year, 2 months agoBaggio13
1 year, 9 months agosaado9
2 years, 5 months agobotherder88
2 years, 5 months ago