During the security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?

Creating procedures is management's responsibility, not the auditor's - doing so would impair auditor independence.

Terminating the audit is premature because the absence of documented procedures does not mean controls or practices are absent.

Compliance testing cannot be meaningfully performed without first understanding what practices or standards exist to test against.

An auditor's role is to assess the actual state of controls, which includes determining whether compensating or informal practices exist even in the absence of formal documentation. Identifying and evaluating existing practices allows the auditor to form an accurate risk opinion and provide meaningful recommendations rather than assuming a complete absence of controls. This aligns with ISACA auditing standards that require evidence gathering before conclusions are reached.