問題文
A regional insurer has just formed its first internal audit group. The chief information officer asks the group to write the access approval procedure that the IT department will follow from next quarter, on the grounds that the auditors have read the most standards. What position should the group take on this request?
選択肢
- Accept the drafting and record the procedure that the partners issue, since the agreement of a control belongs to the pairing that has to sign it.
- Decline the drafting and assess the procedure that the department issues, since the ownership of a control belongs to the function that has to operate it.
- Accept the drafting and circulate the procedure that the reviewers issue, since the assurance of a control belongs to the outsider that has to read it.
- Accept the drafting and exclude the procedure that the auditors issue, since the authorship of a control belongs to the reader that has to follow it.