ISACA Certified Information Systems Auditor (CISA) ExamDomain 1: Information System Auditing ProcessMedium
An IS auditor is preparing an audit report after identifying several critical control weaknesses in a newly implemented cloud-based ERP system. Management has indicated that they disagree with some findings and are concerned about the tone of the report impacting stakeholder confidence. What is the MOST appropriate action for the IS auditor to take?
- ADiscuss management's concerns, ensuring findings are factually accurate and recommendations are constructive, and reflect management's comments in the report if appropriate.
- BDelay the report indefinitely until all disagreements are resolved.
- CRemove the disputed findings to maintain a positive relationship with management.
- DProceed with issuing the report as drafted, citing audit standards.
Show answer & explanationAnswer & explanation
Correct answer: A. Discuss management's concerns, ensuring findings are factually accurate and recommendations are constructive, and reflect management's comments in the report if appropriate.
The IS auditor must ensure factual accuracy and provide constructive recommendations. Addressing management's concerns and reflecting their comments (e.g., planned actions or disagreements) in the report maintains objectivity and professionalism while upholding audit standards.
Why the other options are wrong
- B. Delaying indefinitely is not practical and undermines the timeliness of the audit process.
- C. Removing valid findings compromises the integrity and independence of the audit.
- D. Issuing the report without considering management's input can damage relationships and hinder corrective action, though the auditor must remain independent.
Communicating Audit Results
Communicating audit results involves formally presenting findings, conclusions, and recommendations to management and stakeholders in a clear, concise, and objective manner.
- Report should be timely, accurate, and constructive.
- Management's responses should be considered and, if appropriate, included.
- Purpose is to facilitate corrective action and improve controls.
Memory trick: Clear, Concise, Constructive: CCC for reports.