Best IS Audit Strategy

A.

The best IS audit strategy depends on several factors, including the size and complexity of the organization's IT environment, the risks associated with its information systems, and the regulatory and compliance requirements it must meet.

Option A, performing audits based on impact and probability of error and failure, is a risk-based approach that focuses on the most critical areas of the organization's IT environment. This approach is based on the understanding that not all areas of the IT environment are equally important or risky. The audit team can prioritize their efforts based on the potential impact of a failure and the likelihood of an error or failure occurring. This approach allows the team to focus on the areas that pose the greatest risk to the organization.

Option B, cycling general control and application audits over a two-year period, is a systematic approach that ensures that all areas of the IT environment are audited regularly. However, this approach may not take into account changes in the organization's IT environment, such as the implementation of new systems or the introduction of new risks. Additionally, if the organization's IT environment is particularly large or complex, it may not be feasible to audit all areas within a two-year period.

Option C, conducting general control audits annually and application audits in alternating years, is similar to Option B but places more emphasis on the organization's general controls, which are the controls that apply to all information systems. This approach recognizes that strong general controls are essential for ensuring the security and reliability of all information systems within the organization. However, this approach may not be sufficient to address specific risks associated with individual applications.

Option D, limiting audits to new application system developments, is not a comprehensive approach to IS auditing. It only focuses on new systems and does not address existing systems or potential risks that may arise from changes to those systems.

Overall, Option A, performing audits based on impact and probability of error and failure, is the best IS audit strategy because it is risk-based and allows the audit team to focus on the areas of the IT environment that pose the greatest risk to the organization. However, the specific approach may vary depending on the organization's specific needs and requirements.