Question

During a quality review of a completed IT operations audit, a reviewer notices that one of the audit conclusions states the change management process is 'operating effectively,' but the associated workpaper contains only the auditor's narrative summary of an interview with the change manager. No test results, samples, or supporting artifacts are referenced. What is the reviewer's MOST significant concern regarding this workpaper?

Accepted Answer

The workpaper does not contain sufficient and appropriate evidence to support the stated conclusion

Answer

The workpaper should have been reviewed by the change manager before finalization

Answer

The interview was conducted without a second auditor present as a witness

Answer

The narrative summary was not translated into a formal flowchart of the process