CISA Information System Auditing Process Practice Question
An IS auditor is preparing the audit report after completing fieldwork on an organization's backup and restoration process. Management disagrees with one of the findings and has provided additional evidence. Which of the following is the auditor's MOST appropriate course of action?
⚠ Common exam trap
The trap here is believing the auditor must either defend the original finding or drop it to avoid conflict, when the correct behavior is to objectively evaluate management's new evidence and let it determine the outcome.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Evaluate the additional evidence and revise or retain the finding based on the results
When management supplies additional evidence during report preparation, the auditor's duty is to evaluate it objectively and adjust the finding if warranted. The conclusion must follow the evidence, not the desire to avoid conflict or the assumption that the original finding is always right. Retaining a finding without evaluation or escalating prematurely both fail to demonstrate the objectivity expected of the auditor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Include management's disagreement in the report but keep the finding unchanged
Why it's wrong here
Keeping the finding unchanged without evaluating the new evidence suggests the auditor is not objective. Management's rebuttal evidence may be valid and could change the conclusion. The auditor must first assess whether the evidence alters the finding; only after that assessment should the report reflect either a revised finding or the documented disagreement over an unchanged, evidence-supported finding.
- ✓
Evaluate the additional evidence and revise or retain the finding based on the results
Why this is correct
Auditors must remain objective and evidence-driven. When management provides new evidence, the auditor should assess its relevance and sufficiency, and if it demonstrates the finding is inaccurate or the risk is mitigated, revise the finding accordingly. If it does not, the finding stands, with management's position documented. This preserves both accuracy and auditor independence.
- ✗
Delete the finding to maintain a cooperative relationship with management
Why it's wrong here
Deleting a finding solely to preserve goodwill compromises auditor independence and objectivity. If management's additional evidence is valid, the finding should be revised or removed based on that evidence, not on relationship considerations. Removing valid findings without proper evaluation misleads the audit committee and undermines the credibility of the entire backup and restoration audit.
- ✗
Escalate the dispute to the audit committee before evaluating the evidence
Why it's wrong here
Escalating before evaluating the evidence skips the auditor's own responsibility to assess its relevance and sufficiency. The audit committee should be involved only if the matter remains unresolved after the auditor performs that evaluation. Premature escalation wastes governance time and may signal that the auditor cannot independently resolve routine post-fieldwork disagreements with management over backup findings.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.