ITPEC IP April 2021 Question 64
During a systems audit, systems auditors who are independent of the audit target inspect and evaluate the information systems comprehensively from an objective viewpoint. As a result of the systems audit requested by the management of a company, some problems are found in the effectiveness of the current information systems. Who are the most appropriate persons to whom the systems auditor gives advice and makes recommendations?
Explanation
Management — a systems audit is commissioned by management, and the auditor reports to management with advice and recommendations.
The auditor is independent and only evaluates; the auditor does not fix the problems. The audit report, with its findings and recommendations for improvement, goes to the party that requested the audit, here the company's management, because management has the authority to order improvements and allocate resources. Management then directs the departments concerned, and the auditor follows up on whether the improvements were made.
Answer (c)
Why not others:
- •(a) Stockholders — they did not request this audit and do not direct the company's information systems; statutory financial audits report to them, a systems audit requested by management does not
- •(b) Jurisdictional authority — a regulator receives reports only where a law requires it; it has no role in improving the company's own systems
- •(d) System users — they may be interviewed as evidence, but they have no authority to decide company-wide improvements
Key rule: The systems auditor reports to whoever requested the audit, normally management, and management, not the auditor, is responsible for carrying out the improvements.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.