Maintaining IS Audit Coverage in a Shared IT Infrastructure

D.

The scenario presents a situation where an organization has decided to split into separate entities while still maintaining a shared IT infrastructure. This raises concerns about the coverage of IS audits, which are typically conducted on an annual basis to assess risks in the IT environment. The question asks which approach would be the BEST to ensure that key risk areas within the IT environment are covered as part of the IS audit annual plan.

Let's analyze each of the given options and evaluate their effectiveness:

A. Increasing the frequency of risk-based IS audits for each business entity

Increasing the frequency of risk-based IS audits for each business entity would certainly help to cover the key risk areas within the IT environment. However, it may not be the BEST approach in this scenario as it would be costly and time-consuming to conduct frequent audits for each business entity. Moreover, it may not necessarily address the risks associated with the shared IT infrastructure.

B. Revising IS audit plans to focus on IT changes introduced after the split

Revising IS audit plans to focus on IT changes introduced after the split would also be helpful in identifying key risk areas. However, it may not be sufficient to cover all the risks associated with the shared IT infrastructure. In addition, if there are no significant IT changes introduced after the split, this approach may not be effective.

C. Conducting an audit of newly introduced IT policies and procedures

Conducting an audit of newly introduced IT policies and procedures would be useful in ensuring that the IT environment of each entity is aligned with the new organizational structure. However, it may not cover all the risks associated with the shared IT infrastructure, especially if the policies and procedures are not related to the shared infrastructure.

D. Developing a risk-based plan considering each entity's business processes.

Developing a risk-based plan that considers each entity's business processes would be the BEST approach in this scenario. This would help to identify the key risk areas associated with the shared IT infrastructure and ensure that the IS audit annual plan covers them. This approach would take into account the business processes of each entity and their impact on the shared IT infrastructure. It would also help to allocate audit resources effectively and efficiently.

In conclusion, option D is the BEST approach to ensure that the IS audit annual plan covers the key risk areas within the IT environment in a scenario where an organization splits into separate entities while still maintaining a shared IT infrastructure.