When an organization conducts business process improvements, the IS auditor should be MOST concerned with the:

Question

Options

• Aadequacy of reporting to senior management
• Black of version control over process documentation
• Cadequacy of the controls in the redesigned process
• Dmetrics used to evaluate key operating segments

• A
  6% (2)
• B
  3% (1)
• C
  85% (28)
• D
  6% (2)

Explanation

When an organization redesigns its business processes, the IS auditor's primary responsibility is to ensure that adequate controls are built into the new process - because a redesigned process that lacks proper controls can introduce new risks, compliance gaps, or fraud opportunities that didn't exist before. Controls must be evaluated proactively during redesign, not retrofitted afterward.

Why the distractors are wrong:

• A (reporting to senior management) - Reporting adequacy is a governance concern, not a core audit focus during process redesign itself.
• B (version control over documentation) - This is an administrative/document management issue; important, but secondary to whether the actual process controls work.
• D (metrics for key operating segments) - Performance metrics measure efficiency, not risk or control effectiveness - a management concern, not the auditor's primary focus.

Memory tip: Think of the IS auditor as a "controls detective." Whenever something changes - a process, a system, an org structure - the auditor asks "where did the controls go, and are they still strong enough?" Change = risk, and controls are the auditor's answer to risk.

No community discussion yet for this question.