Governance, risk and compliance · Question 12 of 12
An audit finds that access reviews have not taken place for a year. Which steps are appropriate?
2 answers are correct. Hard
Show answer
Answer
- B Determining the cause and defining an action plan with owners and deadlines
- C Re-checking the implementation later and filing evidence
Explanation
Audit findings are an occasion for improvement. A root cause analysis, a plan with clear responsibilities and dates, and a later check of whether the measures work all make sense. Suppressing findings or falsifying evidence would be dishonest and increase the risk.