List of questions
Related questions
Question 366 - IIA-CIA-Part2 discussion
An internal auditor used a risk and control matrix to prepare a work program for testing a software release. During the engagement planning stage, he tested the design of the release procedure as a key control and concluded that the control was not designed well. During the performance stage, he tested the operation of this control and concluded that it was implemented as designed. Which of the following statements is true regarding this scenario?
A.
The test of the control design should have occurred at the performance stage.
B.
The test of the operating effectiveness of the control was not necessary.
C.
A risk and control matrix is not appropriate for this type of engagement.
D.
The test of the operating effectiveness of the control should have occurred at the planning stage.
Your answer:
0 comments
Sorted by
Leave a comment first