During an audit walkthrough, an IS auditor asked the auditee to open the firewall configuration file to the auditor's email. Which of the following is the auditor's BEST course of action?

Question

Options

• AUse the configuration file from the previous audit
• BReview the configuration file shared by the auditee via email
• CEscalate to senior management as audit rights limitations
• DEmphasize the importance of reviewing live configurations

• A
  6% (3)
• B
  4% (2)
• C
  78% (42)
• D
  13% (7)

Explanation

An IS auditor must review live, current system configurations directly to ensure the evidence is complete, unaltered, and authentic. When an auditee sends the configuration file via email instead of granting direct access, the auditor cannot confirm the file reflects the actual current state-it could be outdated, selectively exported, or modified. This constitutes an audit rights limitation, because the auditor is being denied direct access to audit evidence. The appropriate response is to escalate to senior management to obtain proper access. Using a prior audit's file (A) is not current evidence. Reviewing the emailed file (B) compromises evidence integrity. Emphasizing the importance of live review (D) is insufficient on its own without escalation.

No community discussion yet for this question.