Recent control tests for encryption controls are effective and independence rules allow reliance. What should auditors do to avoid wasteful duplicate testing?
Select an answer to reveal the explanation.
Short Explanation
If the elevator was inspected last week and the rules say you can trust it, don’t rebuild the inspection from zero today. Rely on recent effective control tests when independence allows, and spend energy where risk is still open. Blind retesting everything wastes the shared evidence model.
Full Explanation
When independence and methodology allow, auditors may rely on recent effective compliance control tests instead of fully duplicating work, then concentrate fieldwork on unverified or higher-risk areas. Mandatory full retesting every time, refusing all second-line evidence, or deleting prior tests contradicts efficient IRM audit architecture.