Question

Midway through an IS audit of a payroll application, the auditor discovers that the business has quietly added a new self-service module that was not part of the approved audit scope. Testing this module would require significant additional hours that were not budgeted, and management is now pressing for the module to be included because of recent errors it produced. What is the auditor's BEST course of action?

Accepted Answer

Assess the risk and effort of including the module and, if warranted, formally revise the audit scope and resource plan with the appropriate approval before proceeding

Answer

Immediately expand the fieldwork to cover the new module using slack time from other test areas to keep the overall deadline

Answer

Decline any consideration of the module because it was not in the originally approved engagement scope

Answer

Note the module as an observation in the report but perform no additional testing and issue the report on the original schedule