IIA-CIA-PART2 · Question #356
An internal auditor used a risk and control matrix to prepare a work program for testing a software release. During the engagement planning stage, he tested the design of the release procedure as a…
The correct answer is B. The test of the operating effectiveness of the control was not necessary. If a control is found to be poorly designed during the planning stage, testing its operating effectiveness becomes redundant because even a well-implemented but poorly designed control will not achieve its intended objectives. The primary focus should be on redesigning the…
Question
An internal auditor used a risk and control matrix to prepare a work program for testing a software release. During the engagement planning stage, he tested the design of the release procedure as a key control and concluded that the control was not designed well. During the performance stage, he tested the operation of this control and concluded that it was implemented as designed. Which of the following statements is true regarding this scenario?
Options
- AThe test of the control design should have occurred at the performance stage.
- BThe test of the operating effectiveness of the control was not necessary.
- CA risk and control matrix is not appropriate for this type of engagement.
- DThe test of the operating effectiveness of the control should have occurred at the planning stage.
How the community answered
(13 responses)- A23% (3)
- B62% (8)
- C8% (1)
- D8% (1)
Explanation
If a control is found to be poorly designed during the planning stage, testing its operating effectiveness becomes redundant because even a well-implemented but poorly designed control will not achieve its intended objectives. The primary focus should be on redesigning the control to ensure it is effective in mitigating risks. Therefore, the auditor should not have proceeded to test the operational effectiveness of a control that was already deemed poorly designed.
Topics
Community Discussion
No community discussion yet for this question.