Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
IS audit management may provide guidance, but executive management has the authority to review and validate the risk acceptance decision. Executive management has the authority and accountability for risk management decisions within the organization. By presenting the issue to executive management, the IS auditor ensures that the concern is properly reviewed at a higher level and that management's decision is transparent and well-informed.
Ask our auditors’ boss first
the question doesn't say it is internal or external auditing. Therefore, I think A is the best answer if I was the external auditor and the management doesn't want to resolve the findings and the residual risk is profound. Communicating with the executive management who has the authority over the management is the wat to go.