Exam CISA topic 1 question 314 discussion

Third-party access to an organization's systems presents significant security and compliance risks, so testing controls related to third-party access is essential. If the original audit plan did not include testing for third-party access, it is important to adjust the audit plan to include this critical aspect, ensuring that all access controls are adequately reviewed.

AI says Option A is the most appropriate response because it directly addresses the deficiency by ensuring that testing of third-party access controls is included in the current audit scope. This action is proactive and aims to rectify the identified issue promptly. Therefore, Option A is the correct answer.

Determine whether a risk assessment is in place to plan testing of controls that regulate third-party access.

C. Determine if the risk has been identified in the plan

A. Add testing of third-party access controls to the scope of the audit.

C. Determine whether the risk has been identified in the planning documents.

C. Determine whether the risk has been identified in the planning documents.

Escalate the deficiency to audit management: Escalating the deficiency to audit management is the BEST course of action because it allows the auditor to report the issue to higher management and obtain their support to address the deficiency.