Q). Before reporting results of an audit to senior management, an IS auditor should

A. Confirm the findings with auditees.
B. Prepare an executive summary and send it to auditee management.
C. Define recommendations and present the findings to the audit committee.
D. Obtain agreement from the auditee on findings and actions to be taken.

Answer:

The correct answer is "D". When an audit is completed, an information systems auditor should discuss the audit findings with the auditees. Testing done, outcome of tests as well as testing techniques used should all be discussed with the auditees. Auditee agreement on audit findings helps senior management buyout of audit findings later in the audit.

Related Posts............

How to Pass the CISA Exam - Tip # 1
Passing the CISA Exam in the First Attempt
Deploying an Intrusion Detection System IDS
Confidentiality, Integrity and Availability