An audit identified that a computer system is not assigning sequential purchase order numbers to order requests. The IS auditor is conducting an audit follow-up to determine if management has…

Question

Options

• AReview the documentation of recent changes to implement sequential order numbering
• BExamine a sample of system generated purchase orders obtained from management
• CInspect the system settings and transaction logs to determine if sequential order numbers are
• DInquire with management if the system has been configured and tested to generate sequential

• A
  7% (2)
• B
  3% (1)
• C
  70% (21)
• D
  20% (6)

Explanation

Inspecting system settings and transaction logs (C) is the most reliable procedure because it provides direct, independent evidence that the control is actually functioning - the auditor personally verifies both the configuration and the real transaction output, without relying on anything management supplies or says.

Why the distractors fail:

• A (documentation review) shows that a change was intended or documented, not that it actually works in practice - documentation can be outdated or incomplete.
• B (sample from management) is compromised by the source: management controls which purchase orders you see, so they could inadvertently or deliberately provide a non-representative sample.
• D (inquiring with management) is mere inquiry - the weakest form of audit evidence - because management's assertion that the system works is unverified and self-serving.

Memory tip: Use the "DICO" hierarchy for audit evidence reliability - Direct observation/inspection > Independent documents > Client-provided documents > Oral inquiry. Whenever a question asks for the "most reliable" follow-up, pick the option where you, the auditor, directly examine the system or independent records rather than asking or accepting materials from management.

No community discussion yet for this question.