Which of the following should the auditor do FIRST?

exams CISA CISA exam 0 Comments

An internal IS auditor discovers that a service organization did not notify its customers following a data breach.

Which of the following should the auditor do FIRST?
A . Notify audit management of the finding.
B . Report the finding to regulatory authorities.
C . Notify the service organization’s customers.
D . Require the service organization to notify its customers.

Answer: A