CIA Part 1 — Essentials of Internal Auditing

The organization will definitely experience a cyber incident because the system is old.

Management lacks documented residual-risk acceptance, restore-test evidence, and a funded remediation roadmap for a critical unsupported system.

The auditor personally believes the system is embarrassing.

The issue should be excluded because the system supports revenue-generating operations.