Valid IIA-CIA-Part2 Dumps shared by ExamDiscuss.com for Helping Passing IIA-CIA-Part2 Exam! ExamDiscuss.com now offer the newest IIA-CIA-Part2 exam dumps, the ExamDiscuss.com IIA-CIA-Part2 exam questions have been updated and answers have been corrected get the newest ExamDiscuss.com IIA-CIA-Part2 dumps with Test Engine here:
An internal auditor used a risk and control matrix to prepare a work program for testing a software release. During the engagement planning stage, he tested the design of the release procedure as a key control and concluded that the control was not designed well. During the performance stage, he tested the operation of this control and concluded that it was implemented as designed. Which of the following statements is true regarding this scenario?
Correct Answer: B
If a control is found to be poorly designed during the planning stage, testing its operating effectiveness becomes redundant because even a well-implemented but poorly designed control will not achieve its intended objectives. The primary focus should be on redesigning the control to ensure it is effective in mitigating risks. Therefore, the auditor should not have proceeded to test the operational effectiveness of a control that was already deemed poorly designed. Reference: The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards) "Auditing: A Risk-Based Approach to Conducting a Quality Audit" by Karla M. Johnstone et al.