ITPEC IP October 2024 Question 65
Which of the following is an appropriate description of the roles of a system auditor?
Explanation
Independently verifying that information-system risks are properly controlled and reporting to the client — the auditor evaluates; management builds and runs the controls.
A system auditor stands apart from the audited department. The auditor collects evidence, judges whether the risks of the information system are controlled appropriately and effectively, and reports the result (with findings and recommendations) to the client who commissioned the audit, usually top management. Independence is what makes the evaluation credible.
Answer (c)
Why not others:
- •(a) — preparing workflows and a risk control matrix and installing the system is the work of the business and system departments that own the controls
- •(b) — building self-inspection mechanisms into each process and running the system smoothly is operational management's job
- •(d) — setting policies and objectives and establishing the management system is the responsibility of management
Key rule: Auditors assess and report from an independent position; designing, implementing and operating controls stays with management, or the auditor would be auditing their own work.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.