ISACA Certified Information Systems Auditor (CISA) ExamDomain 1: Information System Auditing ProcessMedium
An IS auditor is reviewing an organization's user access management process. The audit program requires testing the effectiveness of quarterly access reviews. The organization reports that these reviews are performed by system owners, but no formal documentation of the reviews (e.g., sign-off sheets, review logs) is maintained. What is the MOST significant implication of this lack of documentation for the IS auditor?
- AThe auditor can only rely on verbal assurances from the system owners regarding the reviews.
- BThe auditor must perform additional substantive testing of user access to compensate.
- CThe auditor cannot rely on the stated control and must report it as ineffective.
- DThe auditor will have difficulty determining the completeness of the reviews.
Show answer & explanationAnswer & explanation
Correct answer: C. The auditor cannot rely on the stated control and must report it as ineffective.
Without formal documentation, the IS auditor lacks sufficient appropriate audit evidence to confirm that the control (quarterly access reviews) is actually being performed and is effective. This means the auditor cannot rely on the stated control and must report it as ineffective or unproven, which typically leads to increased substantive testing.
Why the other options are wrong
- A. Verbal assurances are generally insufficient as audit evidence for control effectiveness and cannot be relied upon.
- B. While additional substantive testing may be a consequence, the primary implication is the inability to rely on the control itself.
- D. Difficulty in determining completeness is a specific aspect of the broader problem of not being able to rely on the control at all.
Audit Evidence Documentation
The record of audit procedures performed, evidence obtained, and conclusions reached, essential for supporting the auditor's opinion.
- Provides proof of work performed.
- Supports audit findings and conclusions.
- Mandatory for control reliance.
Memory trick: No 'paper trail', no 'proof trail'.