What is the best course of action for a chief audit executive if an internal auditor identifies in the early stage of an audit that some employees have inappropriate access to a key system?

Question

Options

• AContact the audit committee chair to discuss the finding
• BObtain verbal assurance from management that the inappropriate access will be removed
• CIssue an interim audit report so that management can implement action plans
• DAsk the auditor to create a ticket with the IT help desk requesting to revoke the inappropriate

• A
  4% (1)
• B
  4% (1)
• C
  82% (23)
• D
  11% (3)

Explanation

If an internal auditor identifies that some employees have inappropriate access to a key system in the early stage of an audit, the best course of action is to issue an interim audit report so that management can implement action plans. This approach ensures that the identified issue is formally communicated to management promptly, allowing them to take immediate corrective action to mitigate the risk. It also documents the auditor's findings and recommendations, providing a clear audit trail and supporting accountability. Obtaining verbal assurance or creating a ticket might address the issue temporarily but lacks the formal documentation and follow-up mechanisms inherent in an interim audit report.

No community discussion yet for this question.