During the security audit of IT processes, an IS auditor found that there were no documented security procedures. What should the IS auditor do?

Developing procedures is a management responsibility, not an auditor's role - the auditor assesses and reports rather than implements controls.

Terminating the audit is not warranted by the absence of documentation alone, as the audit scope includes assessing informal or ad hoc practices.

Compliance testing requires existing documented standards to test against, making it inapplicable when no documented procedures exist.

An IS auditor's primary responsibility is to gather evidence about the actual state of controls, which includes identifying undocumented but operational practices that management may rely on. Evaluating these existing practices allows the auditor to assess their effectiveness and determine the true risk exposure, producing accurate findings. Skipping this step would lead to incomplete and potentially misleading audit conclusions.