CISA Certified Information Systems Auditor – Question2832 - CISA Certified Information Systems Auditor

A manager of a project was not able to implement all audit recommendations by the target date. The IS auditor should:

A. recommend that the project be halted until the issues are resolved.
B. recommend that compensating controls be implemented.
C. evaluate risks associated with the unresolved issues.
D. recommend that the project manager reallocate test resources to resolve the issues.

Correct Answer: C

Explanation:

Explanation:
It is important to evaluate what the exposure would be when audit recommendations have not been completed by the target date. Based on the evaluation, management can accordingly consider compensating controls, risk acceptance, etc. All other choices might be appropriate only after the risks have been assessed.