Exam CISA topic 1 question 928 discussion

While the lack of formal documentation for steps taken to address identified vulnerabilities (Option B) is also a concern, it may not pose as significant a risk as the failure to report results to individuals with authority. Without proper reporting mechanisms in place, vulnerabilities may persist unchecked, leaving the organization exposed to potential security breaches and threats. Therefore, ensuring that results are reported to individuals with authority is the GREATEST concern for an IS auditor assessing the effectiveness of an organization’s vulnerability scanning program.