Câu 480: CISA: Certified Information Systems Auditor

During the planning stage of a compliance audit, an IS auditor discovers that a bank's inventory of compliance requirements does not include recent regulatory changes related to managing data risk. What should the auditor do FIRST?

1. A. Ask management why the regulatory changes have not been included. — đáp án hiện tại
2. B. Report the missing regulatory updates to the chief information officer (CIO).
3. C. Discuss potential regulatory issues with the legal department.
4. D. Exclude recent regulatory changes from the audit scope.