Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The key issue is that the auditor previously helped develop the KPIs used within risk management. If the auditor subsequently evaluates the effectiveness of IT risk management, those KPIs may form part of the criteria or evidence used in that evaluation. The auditor could therefore be reviewing and relying on their own previous work, creating a self-review threat to objectivity
A Because the employee developed the KPIs while in the risk management department, those KPIs are now the primary tools used to measure the "effectiveness" of the risk management processes. If the auditor now evaluates these processes, they are essentially auditing their own work. They cannot be objective because criticizing the process would be a criticism of the very KPIs they designed.
developing KPI that will be used in the audit dept. by the lead auditor could lead to a potential self review threat as the auditor will have to review the effectiveness of the KPI during the course of performing an integrated audit...