Which of the following should be the IS auditor’s NEXT course of action?

Prior to a follow-up engagement, an IS auditor learns that management has decided to accept a level of residual risk related to an audit finding without remediation. The IS auditor is concerned about management’s decision.

Which of the following should be the IS auditor’s NEXT course of action?
A . Accept management’s decision and continue the follow-up.
B. Report the issue to IS audit management.
C. Report the disagreement to the board.
D. Present the issue to executive management.

View Answer

Answer: B