Handling Non-Cooperative Business Units in IS Audits

B.

As an IS auditor, it is important to ensure that audits are conducted timely and efficiently to identify any potential risks and control weaknesses. However, in some cases, the business unit may not be able to cooperate with a scheduled audit due to their workload. In such situations, the best course of action for the IS auditor would be to:

Option A: Reschedule the audit for a time more convenient to the business unit. This option is reasonable if the business unit representatives can provide a valid reason for their unavailability, and rescheduling the audit will not affect the overall audit plan or deadlines. However, it is important to ensure that the rescheduled audit is conducted within a reasonable timeframe and that the audit scope is not compromised.

Option B: Notify the chief audit executive who can negotiate with the head of the business unit. If the business unit representatives are not willing to cooperate, the IS auditor can escalate the matter to the chief audit executive (CAE). The CAE can use their influence to negotiate with the head of the business unit and explain the importance of the audit. This option is recommended if the IS auditor believes that rescheduling the audit will not be possible or will affect the audit's overall objectives.

Option C: Begin the audit regardless and insist on cooperation from the business unit. Starting the audit without the cooperation of the business unit may compromise the audit's integrity, and the audit results may not be reliable. In addition, forcing the business unit to cooperate may damage the relationship between the audit team and the business unit. Therefore, this option is not recommended.

Option D: Notify the audit committee immediately and request they direct the audit begin on schedule. This option is extreme and should only be used if the business unit's unavailability poses a significant risk to the organization or if the business unit representatives are deliberately avoiding the audit. The audit committee has the authority to direct the audit to proceed on schedule, but it should be used as a last resort.

In summary, the best course of action for the IS auditor is to initially try to reschedule the audit for a more convenient time. If that is not possible, the matter should be escalated to the CAE, who can negotiate with the business unit's head. Only if there is a significant risk to the organization should the audit committee be involved.