During planning for a cloud service audit, audit management becomes aware that the assigned IS auditor is unfamiliar with the technologies in use and…

The primary responsibility of audit management is to ensure that audits are conducted with due professional care, which requires the assigned auditors to be competent in the subject matter. When an auditor lacks the necessary technical knowledge for a specialized area like cloud services, the most immediate and effective action to preserve audit quality is to reassign the engagement to a qualified internal subject matter expert (SME). This directly addresses the identified competency gap, ensuring the audit is performed by an individual with the requisite skills and knowledge to properly assess the risks and controls.

A. A follow-up audit does not correct the quality deficiencies of the initial audit performed by an unqualified auditor.

B. Rescheduling the audit for the next year unacceptably delays the assessment of potentially significant risks to the organization.

D. Extending the audit duration does not compensate for a fundamental lack of technical expertise and will not guarantee a quality outcome.

1. ISACA

IS Audit and Assurance Standard 1202: Competence

2013. Section 1202.2 states

"The IS audit and assurance function shall be collectively competent

having the skills and knowledge to perform the audit work." Section 1202.3 further requires that "IS audit and assurance professionals shall possess the skills and knowledge to perform the audit work." Reassigning the audit to a competent SME directly fulfills this standard.

2. ISACA

IS Audit and Assurance Guideline 2202: Audit Planning

2014. Section 3.3

"Identify Team Members and Competencies

" emphasizes that during planning

audit management must "ensure that the audit team collectively possesses the required skills and knowledge to perform the audit." If the assigned auditor is found to be lacking

the plan must be adjusted

with reassignment being the most logical adjustment.

3. ISACA

CISA Review Manual

27th Edition

2019. Chapter 1

"The Process of Auditing Information Systems

" Section 1.3.3

"Audit Charter

" discusses the authority and responsibility of the audit function

which includes proper resource management. The section on "Audit Planning" (1.4) implicitly requires assigning competent staff to ensure the audit objectives are met.