Exam CISA topic 1 question 83 discussion

For me, A is indeed correct. The auditor is not a forensic expert. Examining the computer directly may compromise key evidence.

A. Contact the incident response team to conduct an investigation. The incident response team is responsible for handling security incidents and conducting investigations. They have the expertise and resources to properly investigate the suspected crime and gather evidence in a forensically sound manner. It is important to involve the incident response team as soon as possible to preserve any evidence and prevent further damage. Advising management of the crime after the investigation, examining the computer to search for evidence supporting the suspicions, and notifying local law enforcement of the potential crime before further investigation may compromise the investigation or result in the loss of important evidence.

I don't think an IS auditor examines the computer

Forensic procedures should be done by the organization

The incident response team should be contacted as an initial response.

Definitely not C because checking other's computer is not IS auditor's job. I think A or B could be the answer.

An IS auditors role is to observe and contact responsible, there A)

I don’t think auditor can perform the searches same as Incident response team therefore it will be inconclusive. On top, auditors role is not meant to perform this type but rather coordinate with relevant team. If auditor does IR job, it defeats the purpose of having IR team in the organisation. :) so the right answer should be A

C. Contact the incident response team to conduct an investigation.

In case of doubt, the auditor looks for evidence. If confident, the auditor will report it to the incident response team.

the evidence first

first of all, auditor need to gather sufficient evidences that support his suspicious, then the auditor shall communicate the conclusion reached with the audit client management, who in turn shall take the necessary corrective measures, like notifying the Incident Response Team

same as above comments

In the first hand, the Auditor needs to have enough evidence first. Examination to have the evidence and confirm the suspect must be performed first before any other action. C is the correct answer here.

Keeping in mind that the Auditor should have enough evidence, suspecting is not enough so C should be the correct answer

In my opinion, no actual incident has been confirmed to occur yet, so the auditor needs more reasonable evidence to confirm his suspicions