Question #1

During a review of an organization's incident response plan (IRP), an IS auditor discovers that the plan does not address several business-critical applications that were migrated to a cloud environment within the past year. What is the MOST appropriate course of action for the IS auditor?

  • A) Notify management of the gap, assess the potential impact, and continue the audit incorporating this finding into the report.

  • B) Terminate the audit engagement since the IRP does not reflect the current IT environment.

  • C) Finalize the audit report based only on the applications addressed in the existing IRP, without mentioning the omitted systems.

  • D) Suspend the audit until the IRP is revised to include the cloud-based applications.

Explanation

A) Professional auditing standards require the IS auditor to communicate material gaps to management as soon as they are identified and to evaluate the risk this omission creates, while continuing to perform the audit as planned so the finding can be properly documented and reported.

B) Terminating the engagement is an excessive response to a control gap and prevents the auditor from fulfilling the original audit objectives or formally reporting the deficiency.

C) Omitting known material information from the audit report conceals a significant risk from management and violates the auditor's obligation to disclose all relevant findings.

D) Suspending the audit delays the delivery of assurance and reporting, and the auditor's role is to identify and communicate the gap within the current engagement rather than wait for remediation before completing the work.