Certified Information Systems Auditor (CISA) — Question 144

Which of the following is the BEST justification for deferring remediation testing until the next audit?

Answer options

• A. The auditor who conducted the audit and agreed with the timeline has left the organization.
• B. Management's planned actions are sufficient given the relative importance of the observations.
• C. Auditee management has accepted all observations reported by the auditor.
• D. The audit environment has changed significantly.

Correct answer: B

Explanation

Option B is correct because it highlights that management's planned actions are appropriate based on the priority of the issues identified, making immediate remediation unnecessary. The other options either reference changes in personnel, acceptance of findings without addressing their importance, or shifts in the audit environment, which do not directly justify the delay in testing remediation.