ITPEC IP April 2018 Question 63
Company A’s internal auditors conduct a system audit concerning the company’s BCP (Business Continuity Plan). The system audit found in the backup measures for computer power supplies that some of the batteries in the uninterruptible power supplies managed by the System Operations Department are deteriorated. Which of the following is the party responsible for making improvements in response to the finding?
Explanation
Head of the System Operations Department — the department that manages the deteriorated UPS batteries owns the fix; the auditor only reports it.
In a system audit the auditor evaluates controls independently and reports findings and recommendations. Improvement is the responsibility of the audited party, the management of the department that owns the activity. The UPS units, and so their batteries, are managed by the System Operations Department, so its head must plan and carry out the replacement; the auditor then follows up to confirm it was done.
Answer (a)
Why not others:
- •(b) Person responsible for system development — development does not manage the operational power equipment
- •(c) Internal auditor — carrying out the improvement would make the auditor audit their own work and lose independence; the auditor recommends and follows up
- •(d) Head of the Purchasing Department — buying the UPS does not make purchasing responsible for maintaining it; the department that manages the equipment is
Key rule: The auditor finds, recommends and follows up; the head of the audited department is responsible for making the improvement.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.