Exam CISA topic 1 question 1164 discussion

The best course of action for the IS auditor, upon discovering that some accounts with database administrator privileges have been assigned a default password with an unlimited number of failed login attempts, is to document the finding and explain the risk of having administrator accounts with inappropriate security settings. Documenting the finding and explaining the risk is an essential step in the audit process. It provides a clear record of the security weakness and its potential impact on the organization. It also serves to raise awareness among relevant stakeholders about the risks associated with weak security settings on administrator accounts.

D. Request the IT manager to change administrator security parameters and update the finding.