Question #1

During a review of an organization's incident response plan (IRP), an IS auditor discovers that the plan does not address several business-critical applications that were migrated to a cloud environment within the past year. What is the MOST appropriate course of action for the IS auditor?

  • A) Notify management of the gap, assess the potential impact, and continue the audit incorporating this finding into the report.

  • B) Terminate the audit engagement since the IRP does not reflect the current IT environment.

  • C) Finalize the audit report based only on the applications addressed in the existing IRP, without mentioning the omitted systems.

  • D) Suspend the audit until the IRP is revised to include the cloud-based applications.