IIA Exam IIA-CIA-Part2 Topic 8 Question 100 Discussion

Step-by-Step Detailed Explanation:

A . The policy for granting, modifying, and deleting user access:

Correct. Understanding the policy ensures the auditor knows the framework and controls in place.

B . A sample of change request forms:

Useful for testing but not as foundational as reviewing the policy.

C . User access reports reviewed by management:

This evaluates monitoring but does not establish a baseline understanding of controls.

D . A current listing of system users and employees:

Important for reconciliation but secondary to understanding the control framework.

CIA Exam Syllabus Reference:

Domain V: Performing Internal Audit Services -- Preliminary Surveys.