If an IS auditor finds discrepancies in responses from a payroll clerk, what should the auditor do?

The appropriate action for an IS auditor upon finding discrepancies in the responses from a payroll clerk is to expand the scope to include substantive testing. This approach allows the auditor to gather additional evidence to evaluate the extent and nature of the discrepancies found. By conducting substantive testing, the auditor can verify the accuracy of payroll transactions, assess whether the discrepancies indicate a systemic issue, and determine if there are deficiencies in internal controls that need to be addressed.

Expanding the scope is essential in this situation because it helps the auditor to ascertain whether the discrepancies are isolated incidents or indicative of broader control failures, leading to informed recommendations for improvement. Substantive testing can include reviewing payroll records, confirming employee data, or assessing compliance with regulatory requirements, which provides a clearer understanding of the payroll process's integrity.

Ensuring that the audit thoroughly examines areas where discrepancies exist is vital for maintaining the credibility of the audit findings and ensuring the organization can trust in the accuracy of its payroll processes. This structured approach helps protect the organization against potential financial and reputational risks associated with payroll errors or fraud.