Which of the following changes intended to improve and streamline an organization's incident management process would be a potential concern to an IS auditor?
Which of the following changes intended to improve and streamline an organization's incident management process would be a potential concern to an IS auditor?
Enabling the capability for the individual reporting the incident to assign priority to a ticket could be a potential concern because it introduces the risk of subjective judgment. Individuals without an overall view of priorities might incorrectly assign priority levels, leading to a mismanagement of critical incidents. This can negatively impact the efficiency and effectiveness of the incident management process, making it a concern for an IS auditor.
option A does indeed present potential concerns regarding the accuracy and context of reporting for aging incidents. While it aims to improve transparency and accountability, there is a risk of misrepresentation if not implemented carefully.
Should be a
B. Enabling the ability for individuals who report incidents to assign priorities to tickets This change is generally expected to have a positive impact as it promotes effective incident management and prioritization. It is expected that reporters will evaluate the importance and urgency of the incident and respond accordingly. Therefore, the change that is of potential concern to IS auditors is "A. Implementing automated reporting for all open incidents older than three months." If this change is not managed properly, there is a risk that it will affect the effectiveness of incident management and the credibility of the organization.
Allowing individual reporters to determine priority runs the risk of subjective judgment and not prioritizing important incidents appropriately, which can lead to less efficient incident management and resolution.