Exam CISA topic 1 question 1744 discussion

When an IS auditor identifies material discrepancies during a follow-up audit—such as paid invoices for devices not recorded in inventory—the auditor must immediately escalate the issue to relevant stakeholders. According to the CISA Review Manual and supporting materials: Auditor Responsibility: The auditor must document findings and present them to management, even if the issue falls outside the initial audit scope. The source material states: "If you identify an issue outside the scope of the audit, don’t disregard it. Document the issue and present it to the client".

As a cyber analyst I can say you never just ask individuals what is happening is where things are. Always assume the worst. In this case I would alert to make it known to many for investigation. I would just just ask the asset management team staff only. I could be wrong but I pick A.

option a This action is crucial because it addresses a potential issue of asset mismanagement or oversight that could lead to financial discrepancies, compliance issues, or security vulnerabilities. By alerting both audit and operations management, the auditor ensures that the discrepancy is investigated promptly and that corrective actions can be taken to rectify the inventory records.

It's B