The most important factor to consider when developing a service level agreement (SLA) is the description of the services from the viewpoint of the client organization, because the SLA should reflect the needs and expectations of the client and specify the measurable outcomes and performance indicators that the provider must deliver34. The description of the services from the viewpoint of the provider, the detailed identification of work to be completed, and the provisions for regulatory requirements that impact the end users' businesses are also important elements of an SLA, but not as crucial as the client's perspective. References: 3: CISA Review Manual (Digital Version), Chapter 5, Section 5.3.1 4: CISA Online Review Course, Module 5, Lesson 3

Residual risk from the findings of previous audits should be the primary basis for prioritizing follow-up audits, because it reflects the level of exposure and potential impact that remains after management has implemented corrective actions or accepted the risk. Follow-up audits should focus on verifying whether the residual risk is within acceptable levels and whether the corrective actions are effective and sustainable. Audit cycle defined in the audit plan, complexity of management's action plans, and recommendation from executive management are not valid criteria for prioritizing follow-up audits, because they do not consider the residual risk from previous audits. References: CISA Review Manual (Digital Version), Chapter 2, Section
2.4.3

The best recommendation for a small IT web development company where developers must have write access to production is to remove production access from the developers. Production access is the ability to modify or update the live systems or applications that are used by customers or end users. Production access should be restricted to authorized and qualified personnel only, as any changes or errors in production can affect the functionality, performance, or security of the systems or applications. Developers should not have write access to production, as they may introduce bugs, vulnerabilities, or inconsistencies in the code that can compromise the quality or reliability of the systems or applications. The other options are not as effective as removing production access from the developers, as they do not address the root cause of the problem or provide the same benefits. Hiring another person to perform migration to production is a costly solution that can help segregate the roles and responsibilities of developers and migrators, but it does not remove production access from the developers. Implementing continuous monitoring controls is a good practice that can help detect and correct any issues or anomalies in production, but it does not remove production access from the developers. Performing a user access review for the development team is a detective control that can help verify and validate the access rights and privileges of developers, but it does not remove production access from the developers. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.2

The best course of action for the IS auditor is A. Escalate to IT management for resolution. This is because IT management is responsible for overseeing and coordinating the IT activities and functions within the organization, and ensuring that they comply with the audit findings and recommendations1. IT management can help resolve the issue of finding ownership by:
* Clarifying and communicating the roles and responsibilities of each IT team, and how they relate to the finding and its remediation2.
* Evaluating and assigning the finding to the most appropriate IT team, based on their expertise, authority, and availability2.
* Providing guidance and support to the assigned IT team, and monitoring their progress and performance in remediating the finding2.