What should internal audit do when a critical process depends on unsupported technology?

Question

AcadiFi · Accepted Answer

Frame this as a legacy technology risk question. The CIA exam is usually asking for the professional sequence, not the loudest rea...

Unlock with Scholar — $19/month

Get full access to all Q&A answers, practice question explanations, and progress tracking.

Start 7-Day Free Trial Compare Plans

No credit card required for free trial

At fictional Falcon River Components runs a critical production application on an unsupported operating environment. Internal audit identifies security, availability, backup, vendor support, and change-management risks. The internal auditor should identify the objective first, then decide what evidence is relevant and sufficient. If the fact pattern involves audit management, the same discipline applies: clarify authority, competence, resources, and stakeholder expectations before choosing a response.

```mermaid
flowchart LR
  A[Legacy dependency] --> B[Risk assessment]
  B[Risk assessment] --> C[Controls]
  C[Controls] --> D[Response]
  D[Response] --> E[Residual risk]
```

The common trap is treating operational necessity as proof that the risk is acceptable. A weaker answer either jumps to a conclusion without evidence or treats the issue as a personality problem. A stronger answer names the risk, ties it to criteria, gathers evidence, and communicates the result to the right level of management or the board.

For exam purposes, state that legacy systems can remain temporarily, but residual risk and accountability must be explicit. Then apply the facts: what is known, what is missing, what procedure is appropriate, and what communication or follow-up is needed. That pattern works across Part 1 governance questions, Part 2 engagement-performance questions, and Part 3 business or technology scenarios. Practice more in our CIA Part 3 question bank.

What should internal audit do when a critical process depends on unsupported technology?

Master Part 3 with our CIA Course

Related Questions

Practice Questions