Certified Information Systems Auditor (CISA) — Question 74

When reviewing past results of a recurring annual audit, an IS auditor notes that findings may not have been reported and independence may not have been maintained. Which of the following IS the auditor's BEST course of action?

Answer options

• A. Reevaluate internal controls
• B. Re-perform past audits to ensure independence
• C. Inform senior management
• D. Inform audit management

Correct answer: D

Explanation

The best action for the auditor is to inform audit management as they are responsible for overseeing the audit process and ensuring compliance with auditing standards. Informing senior management may not address the core issue of audit independence. Reevaluating internal controls or re-performing past audits may not be feasible or effective without first addressing the reporting and independence concerns.