ISACA Certified Information Systems Auditor (CISA) ExamDomain 1: Information System Auditing ProcessHard
An IS auditor is preparing the final audit report for a significant audit of an organization's critical payment processing system. The audit identified several high-risk findings related to access controls and data encryption. Senior management has requested that the report emphasize the positive aspects of the system and downplay the severity of the findings to avoid negative publicity. What is the MOST appropriate course of action for the IS auditor?
- AIssue a separate, confidential report to the audit committee detailing the high-risk findings, and a modified public report for management.
- BReclassify the high-risk findings as medium-risk to align with management's perception, but ensure recommendations remain strong.
- CPresent the findings factually and objectively, clearly stating the risks and recommendations, regardless of management's request.
- DComply with management's request to maintain a good working relationship, while ensuring the underlying issues are still addressed internally.
Show answer & explanationAnswer & explanation
Correct answer: C. Present the findings factually and objectively, clearly stating the risks and recommendations, regardless of management's request.
ISACA's Code of Professional Ethics requires IS auditors to perform their duties with objectivity, due diligence, and professional care. Presenting findings factually and objectively, without bias or undue influence, is paramount to maintaining the auditor's independence and credibility. Compromising the report's integrity would violate ethical standards.
Why the other options are wrong
- A. Issuing separate reports could be perceived as circumventing management and does not address the fundamental ethical obligation to present a single, objective, and truthful report.
- B. Reclassifying risk levels to appease management is a direct breach of auditor objectivity and professional ethics.
- D. Complying with management's request to downplay findings compromises auditor independence and objectivity, violating ethical principles.
Auditor Objectivity
The ethical principle requiring auditors to be impartial and unbiased in their work, free from conflicts of interest or undue influence.
- Essential for audit credibility.
- Ensures unbiased reporting of facts.
- A cornerstone of professional ethics.
Memory trick: An auditor's report must stand tall and true, like a 'lighthouse of truth' in stormy seas.