問題文
A documented control requires the operations manager to review the privileged access report each month. The report is generated and filed every month, but there is no evidence of any review for eleven of the twelve months. How should the auditor conclude?
選択肢
- The design is adequate but the control did not exist, so the auditor should treat the whole period as acceptable and test the underlying risk by another means during the engagement.
- The design is adequate but the control did not operate, so the auditor should treat the kept file as acceptable and test the underlying risk by another means during the engagement.
- The design is adequate but the control did not operate, so the auditor should treat the whole period as unsupported and test the underlying risk by another means during the engagement.
- The design is adequate but the control did not exist, so the auditor should treat the kept file as unsupported and test the underlying risk by another means during the engagement.