Recent control tests for encryption controls are effective and independence rules allow reliance. What should auditors do to avoid wasteful duplicate testing?
Select an answer to reveal the explanation.
Short Explanation
If the elevator was inspected last week and the rules say you can trust it, don’t rebuild the inspection from zero today. Rely on recent effective control tests when independence allows, and spend energy where risk is still open. Blind retesting everything wastes the shared evidence model.
Full Explanation
When recent control tests for encryption controls are effective and independence rules allow reliance, auditors should rely on those tests and focus fieldwork on gaps or higher-risk areas. Reliance avoids wasteful duplicate testing while preserving assurance quality under governed rules. Shared evidence models only pay off when Audit is allowed to use them appropriately.
Always re-executing every control test from scratch regardless of recent effective results wastes capacity and ignores IRM’s shared testing value. Ignoring all compliance evidence because Audit may never rely on second-line work is an absolute that many standards do not require when independence criteria are met. Deleting prior control test records for a clean slate destroys useful evidence and history.
Exam caveat: reliance is conditional on independence rules and recency/effectiveness—not forbidden universally, not mandatory blind retesting, not license to delete history.
Operational check: document reliance decisions against independence criteria; sample relied-upon encryption tests; redirect fieldwork hours to higher residual gaps; never delete prior test records to force retesting.
Record reliance worksheets citing test IDs, dates, results, and independence assessment; if reliance is denied, document why and retest selectively. Preserve prior control-test history—deletion is never a clean-slate strategy for encryption assurance.