The auditor's next action after finding that there is an informal unwritten set of standards in the IS department is to document and test compliance with the informal standards. This is because the auditor's role is to evaluate the adequacy and effectiveness of the existing controls, regardless of whether they are formal or informal, written or unwritten. The auditor should also assess the risks and implications of having informal standards, such as lack of consistency, accountability, or traceability. The auditor should not make recommendations, postpone the audit, or finalize the audit without performing the audit procedures. References:
* CISA Review Manual (Digital Version), Chapter 2, Section 2.21
* CISA Online Review Course, Domain 1, Module 1, Lesson 12

Section: The process of Auditing Information System
Explanation

Section: The process of Auditing Information System
Explanation/Reference:

IS auditors should review access-control lists (ACL) to determine user permissions that have been granted for a particular resource.

Explanation/Reference:
Explanation:
Software for centralized tracking and monitoring would allow a USB usage policy to be applied to each user based on changing business requirements, and would provide for monitoring and reporting exceptions to management. A policy requiring dismissal may result in increased employee attrition and business requirements would not be properly addressed. Disabling ports would be complex to manage and might not allow for new business needs. Searching of personnel for USB storage devices at the entrance to a facility is not a practical solution since these devices are small and could be easily hidden.