Question

Six months after issuing a report on weaknesses in the change management process, an IS auditor is preparing to conduct follow-up activities. Management previously committed to implementing a formal change approval workflow and provided a memo stating the workflow is now 'fully operational.' What is the auditor's MOST appropriate next step?

Accepted Answer

Obtain and test evidence of actual change records to verify the workflow is functioning as described

Answer

Accept management's written assertion that the workflow is operational and close the finding

Answer

Re-issue the original report to remind management of the outstanding commitment

Answer

Escalate the matter to the audit committee because the remediation was not completed on time