According to IIA guidance on IT auditing, which of the following would not be an area examined by the internal audit activity?
A) Access system security.
B) Policy development.
C) Change management.
D) Operations processes.

Question

Quizplus · Accepted Answer

Policy development is typically not examined by internal audit as it is considered a management responsibility, whereas the other options are areas where internal audit would assess controls and processes.

According to IIA Guidance on IT Auditing, Which of the Following