First Course of Action for Unimplemented Recommendations

C.

As an IS auditor, the first course of action should be to assess the reason for the disagreement before making any decision. Therefore, option C "assess the reason for the disagreement" is the correct answer.

The IS auditor should understand the reason for the disagreement and evaluate whether the original recommendation is still relevant and applicable. The auditee may have valid reasons for disagreeing, such as changes in the organization's structure, processes, or resources that make the implementation of the recommendation no longer feasible. Alternatively, the auditee may have misunderstood the recommendation or may be hesitant to implement it due to the cost or complexity involved.

After assessing the reason for the disagreement, the IS auditor should communicate with the auditee and try to come to a mutual understanding. This includes explaining the importance and benefits of the original recommendation, and the potential risks or consequences of not implementing it. It is essential to maintain a constructive and professional relationship with the auditee, rather than forcing the implementation of a recommendation without their agreement or cooperation.

If the auditor determines that the original recommendation is still valid and necessary, and the auditee is not willing to implement it, the auditor should escalate the matter to the audit committee (option B). The audit committee can then review the situation and make a final decision based on the audit report, the auditor's assessment, and the auditee's response.

Excluding the finding in the follow-up audit report (option A) is not the appropriate course of action. The IS auditor must report any findings and recommendations that were made during the audit process, regardless of whether they were implemented or not. Excluding the finding could be seen as compromising the auditor's independence and objectivity, and may create an inaccurate picture of the organization's internal controls.

Requiring implementation of the original recommendation without assessing the reason for the disagreement (option D) can lead to conflicts and resistance from the auditee. It can also damage the relationship between the auditee and the auditor, and compromise the effectiveness of future audits. The IS auditor should always seek to understand the auditee's perspective and work collaboratively to achieve the desired outcome.