When planning a follow-up, the IS auditor is informed by operational management that recent organizational changes have addressed the previously identified risk and implementing the action plan is no longer necessary. What should the auditor do NEXT?

A. Review the changes and determine whether the risks have been addressed.

B. Accept management's assertion and report that the risks have been addressed.

C. Report that the changes make it impractical to determine whether the risks have been addressed.

D. Determine whether the changes have introduced new risks that need to be addressed.








 

Suggested Answer: A





This question is in CISA Certified Information Systems Auditor Exam
For getting Certified Information Systems Auditor (CISA) Certificate










Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by ISACA. 
Trademarks, certification & product names are used for reference only and belong to ISACA.
The website does not contain actual questions and answers from ISACA's Certification Exams.