Report, don't fix

Rule

Report, don't fix

Exam

CISA

What it means

An IS auditor identifies, evaluates and reports. When an option has the auditor changing a configuration, deleting data or running a process, it is almost always wrong. Correcting problems is management's job; doing it yourself destroys your independence.

The trap answer looks like

The auditor reconfigures the firewall, deletes the orphaned accounts or restarts the failed job.

The winning answer looks like

The auditor reports the issue, with its risk, to the management who own the system.

Worked example

An IS auditor finds active accounts for staff who left months ago. What should the auditor do?

❌ Disable the accounts immediately
✅ Report the finding and its risk to management so they can remove the accounts and fix the leaver process

Disabling them feels responsible, but it makes the auditor part of the control they are auditing.