The IS auditor's immediate responsibility is to report findings and significant developments within the audit's chain of command. The decision by new management to not implement previously accepted recommendations represents a change in risk acceptance and is a material finding for the follow-up audit. The auditor must report this to the audit manager, who is responsible for overseeing the audit engagement. The audit manager will then determine the appropriate next steps, which may include discussing the issue with senior management and deciding whether escalation to the audit committee is warranted. This ensures that the audit function's internal procedures and reporting lines are respected.

A. Notifying the chair of the audit committee is a significant escalation. This step should be determined by audit management, not undertaken unilaterally by the auditor as a first action.

C. Retesting the control is irrelevant. The issue is not the control's operational effectiveness but management's conscious decision not to implement the agreed-upon remediation.

D. Closing the audit finding is incorrect. The finding cannot be closed because the risk has not been mitigated as planned. Management's decision to accept the risk must be documented and reported.

---

1. ISACA

CISA Review Manual

27th Edition. Chapter 1

The Process of Auditing Information Systems

p. 59. The manual states

"The IS auditor should report to the audit manager/director... The audit manager/director is responsible for ensuring that the communication is directed to the appropriate parties." This establishes the correct internal reporting line that the auditor must follow.

2. ISACA

ITAF: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Guideline 2401 Reporting

Section 2401.7 Supervisory Review. This guideline emphasizes that "IS audit and assurance work papers should be reviewed by a senior member of the IS audit and assurance function before the audit reports are finalized and issued." This reinforces the principle that findings

especially significant ones like a change in management's risk posture

must be reviewed internally by management (i.e.

the audit manager) first.

3. ISACA

CISA Review Manual

27th Edition. Chapter 1

The Process of Auditing Information Systems

p. 61. Regarding follow-up

it notes

"If management has assumed the risk of not correcting the reported condition

this should be documented by the IS auditor and communicated to senior management and the audit committee." While this communication is necessary

the process begins with reporting the situation to the audit manager

who then directs these subsequent communications.