Question

An IS auditor is testing whether user access requests are properly approved before provisioning. Using attribute sampling, the auditor sets a tolerable deviation rate of 5% and tests 60 access requests. The auditor finds 4 requests that were provisioned without documented approval, yielding a sample deviation rate of 6.67%. What is the auditor's MOST appropriate next step?

Accepted Answer

Conclude the control cannot be relied upon and consider expanding testing or reporting a control deficiency

Answer

Conclude the control is operating effectively because only 4 exceptions were found in 60 items

Answer

Remove the 4 exceptions from the sample and recalculate the deviation rate to fall below the tolerable rate

Answer

Immediately issue an unqualified opinion since the deviation rate is close to the tolerable rate