Certified Information Systems Auditor (CISA) — Question 375

An IS auditor is informed that several spreadsheets are being used to generate key financial information. What should the auditor verify NEXT?

Answer options

• A. Whether adequate documentation and training is available for spreadsheet users
• B. Whether the spreadsheets meet the minimum IT general controls requirements
• C. Whether there is a complete inventory of end-user computing (EUC) spreadsheets
• D. Whether the spreadsheets are being formally reviewed by the chief financial officer (CFO)

Correct answer: C

Explanation

The correct answer is C because establishing a complete inventory of end-user computing (EUC) spreadsheets is fundamental for understanding the scope and potential risks associated with their use. Options A, B, and D are important aspects, but they are secondary to first ensuring that all spreadsheets are accounted for and managed appropriately.