During a security audit of IT processes, an IS auditor found that there was no documented security procedures. What should the IS auditor do?

During a security audit of IT processes, an IS auditor found that there was no documented security procedures. What should the IS auditor do?
A . Terminate the audit.
B . Identify and evaluate existing practices.
C . Create a procedures document
D . Conduct compliance testing

View Answer

Answer: B