Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Changes have not been tested . first is to check for changes , if that was included in the policy then it goes against it , this is the first gap , second if it was not mentioned in the policy then we have two recommended action items . 1 is to embed testing changes within the IT policy and second to actually do the changes on frequency basis
From an ISACA risk-based auditing perspective, an auditor’s actions must always be guided by risk assessment and evidence gathering before forming a conclusion. Here, the auditor discovered that data integrity testing between systems has not been performed since implementation. Before concluding that this is a control deficiency or documenting it as a finding, the auditor should determine whether any changes have occurred in the systems or interfaces that could impact data integrity. If there have been system changes, this represents higher risk, and the auditor should then recommend testing. If no changes have been made, the risk might be lower, and testing may not be urgently required.
C. Review relevant system changes is the best next step because it helps the auditor determine whether any modifications have occurred in the systems or interfaces that could affect data integrity. If no changes have occurred since implementation, the risk may be lower. If changes have been made, the lack of re-testing becomes a more serious control gap. Comparisons: A. Review previous system interface testing records – Useful to establish a baseline, but not sufficient on its own. You still need to assess what has changed since that time. B. Document the finding in the audit report – This may be appropriate eventually, but the auditor needs to gather more context (such as system changes) before determining the risk and significance of the finding. D. Review IT testing policies and procedures – Helps understand expected practices, but it doesn’t assess the actual risk posed by the current situation.