Question

During the closing meeting for an audit of the procurement system, the process owner strongly disputes a finding in the draft report, claiming the auditor misunderstood a compensating control that was in place. The auditor believes the finding is valid but has not yet reviewed the specific control the owner is describing. What should the IS auditor do FIRST?

Accepted Answer

Obtain and evaluate the additional evidence about the compensating control before finalizing the finding

Answer

Remove the finding from the report to preserve a good working relationship with the auditee

Answer

Issue the final report as drafted and document the process owner's disagreement in a management response section

Answer

Escalate the disagreement immediately to the audit committee for resolution