Question

an IT auditor has determined that a number of user ID requests have not been properly authorized according to company policy. the IT auditor should

a. communicate this concern to senior management as soon as possible

b. perform additional audit procedures to better understand the root cause of the problem

c. disregard the finding if the risk is low

d. communicate this concern to the audit committee as soon as possible

Answer 1

The answer is: The IT auditor should perform additional audit procedures to better understand the root cause of the problem.

• The IT auditor should identify whether the issue was caused by managers not following procedures, by a problem with the workflow of the automated system or a combination of the two.
• Before making any recommendation, the IT auditor should gain a good understanding of the scope of the problem and what factors caused this incident.