Reviewing Business Continuity Plan (BCP)

D.

The scenario presented raises the issue of a potential conflict of interest for the IS auditor. As the auditor previously worked in the organization's IT department and was involved in the design of the business continuity plan (BCP), it may be difficult for the auditor to maintain an objective and impartial viewpoint during the BCP review.

In such cases, it is essential that the IS auditor adheres to professional standards and guidelines and takes appropriate steps to manage the conflict of interest. The IS auditor should not simply decline the audit assignment or document the conflict of interest in the audit report without taking any further action.

The best course of action for the IS auditor in this scenario is to communicate the conflict of interest to the audit manager before starting the assignment. By doing so, the auditor can discuss the potential conflict of interest with the audit manager and determine whether the auditor's participation in the audit would compromise the independence or objectivity of the audit. The audit manager can also take steps to mitigate the conflict of interest, such as assigning a different auditor to review the BCP or implementing additional oversight procedures.

If the audit manager determines that the IS auditor can participate in the BCP review while maintaining independence and objectivity, the auditor should disclose the potential conflict of interest in the audit report. The auditor should also document any actions taken to manage the conflict of interest and provide assurance that the audit was conducted in accordance with professional standards and guidelines.

It is not appropriate for the IS auditor to communicate the conflict of interest directly to the audit committee. This is the responsibility of the audit manager or other appropriate management personnel. The audit committee should be informed of any potential conflicts of interest that may impact the audit, but this should be done through appropriate channels and in accordance with established policies and procedures.