Auditor response to management risk remediation claims?
Short answer
A Review the changes and determine whether the risks have been addressed.
Question
Key Takeaways
This question tests the auditor's obligation to validate evidence rather than relying on management assertions, with the trap being the temptation to skip verification or focus prematurely on new risks.
Auditors must independently verify management's claims regarding risk remediation during follow-up procedures. The consensus is that accepting assertions without testing violates audit independence and due diligence.
Common mistake: Selecting B (Accept management's assertion) because it seems efficient, or D (Determine new risks) before confirming the original risk is actually resolved.
Expert Analysis
Why the Answer Is Correct
Option A is correct because auditors must maintain objectivity and independence. Relying solely on management's word is insufficient; the auditor must review the specific changes to validate that the controls effectively mitigate the previously identified risk.
Why the Other Options Are Wrong
Option B violates the principle of independent verification. Option C is incorrect because auditors are expected to assess changes, not declare them impractical to evaluate. Option D is a secondary step; one must first confirm the original risk is addressed before assessing for new ones.
Community Comment Notes
Comment [1] emphasizes the need to validate claims and ensure independence. Comment [3] clarifies the sequence: "First A, then D," reinforcing that reviewing the changes is the immediate priority before looking for new risks.
Exam Strategy
Always prioritize the sequence of audit steps. When management claims a fix, verify the fix first (testing), then look for side effects (new risks).
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
BenHung 👍 1 Answered Areason: Validate management’s claims: Auditors cannot rely solely on management's statements but should independently review changes to confirm whether risks are actually being addressed. This includes reviewing relevant documentation, processes and technical implementation to ensure the changes are indeed effective. Ensure audit independence: The auditor's role is to provide an objective assessment, not to directly accept management's assertions. By reviewing changes, auditors can ensure that their conclusions are based on facts and evidence. Avoid potential new risks: Organizational changes may introduce new risks, and auditors need to assess whether these changes have had an impact on the overall risk profile.
-
MJORGER 👍 1D. Determine whether the changes have introduced new risks that need to be addressed. The IS auditor should not simply accept management's assertion without further investigation. Instead, they should critically evaluate the changes made by management to determine whether they effectively mitigate the identified risks or if they have introduced new risks.
-
marc4354345 👍 1First A, then D.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISA Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISA Practice Test →