Certified Information Systems Auditor (CISA) — Question 1233

Which of the following is acceptable to be left out of a final audit report?

Answer options

• A. The nature and extent of audit procedures conducted
• B. Significant findings previously communicated to management
• C. Findings of minimal risk to the overall organization
• D. The cause and risk associated with a reported issue

Correct answer: C

Explanation

Option C is correct because findings that present minimal risk do not need to be included in the final audit report, as they do not significantly impact the organization. In contrast, options A, B, and D involve essential information about audit procedures, significant findings, and the implications of reported issues, which are critical for the completeness and usefulness of the report.