Exam CISA topic 1 question 1391 discussion

reason: Validate management’s claims: Auditors cannot rely solely on management's statements but should independently review changes to confirm whether risks are actually being addressed. This includes reviewing relevant documentation, processes and technical implementation to ensure the changes are indeed effective. Ensure audit independence: The auditor's role is to provide an objective assessment, not to directly accept management's assertions. By reviewing changes, auditors can ensure that their conclusions are based on facts and evidence. Avoid potential new risks: Organizational changes may introduce new risks, and auditors need to assess whether these changes have had an impact on the overall risk profile.

First A, then D.

D. Determine whether the changes have introduced new risks that need to be addressed. The IS auditor should not simply accept management's assertion without further investigation. Instead, they should critically evaluate the changes made by management to determine whether they effectively mitigate the identified risks or if they have introduced new risks.