Certified Information Systems Auditor (CISA) — Question 270

External experts were used on a recent IT audit engagement. While assessing the external experts' work, the internal audit team found some gaps in the evidence that may have impacted their conclusions. What is the internal audit team's BEST course of action?

Answer options

• A. Engage another expert to conduct the same testing.
• B. Report a scope limitation in their conclusions.
• C. Recommend the external experts conduct additional testing.
• D. Escalate to senior management.

Correct answer: C

Explanation

The best course of action is to recommend that the external experts conduct additional testing to address the identified gaps in evidence, which may lead to more accurate conclusions. Engaging another expert (option A) may not resolve the issue as effectively as having the original experts provide further evidence. Reporting a scope limitation (option B) may not be necessary if additional testing can clarify the findings. Escalating to senior management (option D) may be premature without first attempting to resolve the issues with the external experts.