CISA · Question #614
An IS auditor is auditing the operating effectiveness of weekly user access reviews. Of the five weekly reviews sampled, one has not been signed or dated. What is the MAIN reason to note this…
The correct answer is D. The review may not have been performed. Evidence of a control's performance must be verifiable. A missing signature or date means there is no confirmation that the review was actually performed. This undermines the completeness and reliability of the control. Accuracy (A) and content (B) relate to quality but do not…
Question
An IS auditor is auditing the operating effectiveness of weekly user access reviews. Of the five weekly reviews sampled, one has not been signed or dated. What is the MAIN reason to note this observation as a finding?
Options
- AThe review may not be accurate.
- BThe review may not contain the appropriate content.
- CThe review may not be in compliance with industry standards.
- DThe review may not have been performed.
How the community answered
(31 responses)- A10% (3)
- B3% (1)
- C6% (2)
- D81% (25)
Explanation
Evidence of a control's performance must be verifiable. A missing signature or date means there is no confirmation that the review was actually performed. This undermines the completeness and reliability of the control. Accuracy (A) and content (B) relate to quality but do not address the missing attestation. Industry standards (C) may be relevant, but the auditor's main concern is that the absence of sign-off creates doubt about whether the control occurred at all. ISACA audit guidance highlights that sufficient and appropriate evidence is required to support the conclusion that a control is operating as designed.
Topics
Community Discussion
No community discussion yet for this question.