Auditor response to management risk remediation claims?

IT Audit Process
Answer Correct answer: A — Review the changes and determine whether the risks have been addressed.

When planning a follow-up, the IS auditor is informed by operational management that recent organizational changes have addressed the previously identified risk and implementing the action plan is no longer necessary. What should the auditor do NEXT?

  1. Review the changes and determine whether the risks have been addressed. Correct Answer
  2. Accept management's assertion and report that the risks have been addressed.
  3. Report that the changes make it impractical to determine whether the risks have been addressed.
  4. Determine whether the changes have introduced new risks that need to be addressed.
audit follow-up procedures isaca audit evidence management assertion validation cisa audit independence

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the auditor's obligation to validate evidence rather than relying on management assertions, with the trap being the temptation to skip verification or focus prematurely on new risks.

Auditors must independently verify management's claims regarding risk remediation during follow-up procedures. The consensus is that accepting assertions without testing violates audit independence and due diligence.

Selecting B (Accept management's assertion) because it seems efficient, or D (Determine new risks) before confirming the original risk is actually resolved.

Community Discussion (3 comments)

BenHung 👍 1 Selected: A
reason: Validate management’s claims: Auditors cannot rely solely on management's statements but should independently review changes to confirm whether risks are actually being addressed. This includes reviewing relevant documentation, processes and technical implementation to ensure the changes are indeed effective. Ensure audit independence: The auditor's role is to provide an objective assessment, not to directly accept management's assertions. By reviewing changes, auditors can ensure that their conclusions are based on facts and evidence. Avoid potential new risks: Organizational changes may introduce new risks, and auditors need to assess whether these changes have had an impact on the overall risk profile.
marc4354345 👍 1
First A, then D.
MJORGER 👍 1
D. Determine whether the changes have introduced new risks that need to be addressed. The IS auditor should not simply accept management's assertion without further investigation. Instead, they should critically evaluate the changes made by management to determine whether they effectively mitigate the identified risks or if they have introduced new risks.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Option A is correct because auditors must maintain objectivity and independence. Relying solely on management's word is insufficient; the auditor must review the specific changes to validate that the controls effectively mitigate the previously identified risk.

Why the Other Options Are Wrong

Option B violates the principle of independent verification. Option C is incorrect because auditors are expected to assess changes, not declare them impractical to evaluate. Option D is a secondary step; one must first confirm the original risk is addressed before assessing for new ones.

Community Comment Notes

Comment [1] emphasizes the need to validate claims and ensure independence. Comment [3] clarifies the sequence: "First A, then D," reinforcing that reviewing the changes is the immediate priority before looking for new risks.

Exam Strategy

Always prioritize the sequence of audit steps. When management claims a fix, verify the fix first (testing), then look for side effects (new risks).

Related Analysis

An organization uses system interfaces to disburse money to

S-Grade

Shortly after a system was deployed into production, it was

A-Grade

An IS auditor has been asked to review the integrity of data

A-Grade

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide