Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
An IS auditor must maintain independence and objectivity to provide unbiased assurance. Implementing security controls is a management function and creates a conflict of interest for the auditor. The auditor should refuse to perform tasks that impair independence, such as designing or implementing controls they will later audit. Option B (communicating the conflict) is good practice but doesn’t resolve the independence issue itself. Option C (performing the assignment anyway) violates professional ethics. Option D (obtaining approval) does not remove the independence conflict.
Auditors should maintain independence and objectivity, which means they should not take on operational responsibilities (like implementing controls) because doing so could compromise their ability to provide an unbiased audit opinion.
While refusing to perform the task is one way to handle the situation, communicating the conflict ensures that the issue is formally acknowledged and managed according to organizational policies. This approach helps in maintaining professional standards and ensuring that the audit function remains effective and unbiased.