ITPEC IP April 2019 Question 64

Improvement plan — after the audit, the audited department answers the auditors' findings with a plan to fix them.

A system audit runs: audit plan, then the audit itself with the collection of audit evidence, then the system audit report with findings and recommendations, then follow-up. The auditor does not fix anything. The audited department, which owns the system, draws up an improvement plan stating what will be changed, by whom and by when, and the auditor later follows up on its progress.

Answer (a)

Why not others:

• •(b) Audit evidence — collected by the auditors during the audit to support their opinion, before any evaluation results exist
• •(c) Service level agreement — an agreement between a service provider and its users on service levels, unrelated to audit results
• •(d) System audit report — written by the system auditor to report the evaluation and recommendations; it is what the audited department responds to

Key rule: The auditor collects evidence, writes the report and makes recommendations; the audited department prepares and carries out the improvement plan, and the auditor follows it up.

System Audit · AI-written, may contain errors