The internal audit department for a company has created scripting language for continuous auditing purposes. These scripts were provided to the IT group for continuous monitoring purposes. This situation introduces a potential conflict related to the auditor's independence and objectivity. Which of the following actions would be the most effective to resolve this issue?

The internal audit team should identify the areas where these scripts are in use and minimize the audit scope and frequency for those areas.

Since continuous monitoring and continuous auditing are similar, IT management should have the continuous monitoring tasks delegated to the internal audit department.

The internal audit team should stop sharing the scripts so that IT management must create its own scripts.

IT management should continue to use the scripts for continuous monitoring purposes with the understanding that it is responsible for testing and maintaining the scripts that it uses.

Explanation

The described situation is one of professional independence. Those individuals within the IS audit department who developed the scripting language should not audit the effectiveness of the scripts themselves for a reasonable period of time. Apart from the actual scripts, IS auditors are free to audit the monitoring process because the process was neither prescribed nor recommended by the audit department. Continuous monitoring is a responsibility of IT management and cannot be handed over to the internal audit team. Continuous auditing is a function of the audit team and is not a substitute for continuous monitoring. Moreover, the internal audit team cannot assume that their scripts are being used appropriately by IT management or that their scripts have not been modified, which then could give erroneous results. Simply reducing the audit scope and frequency in areas where continuous monitoring is used does not imply risk-based auditing and is inappropriate.