What should the IS auditor FIRST establish when auditing the proposed acquisition of a new computer system?

A. a clear business case has been approved by management.

The first concern of the IS auditor should be to establish that the proposal meets the needs of the business, and this should be established by a clear business case. Although compliance with security standards is essential, as are meeting the needs of the users and having users involved in the implementation process, it is too early in the procurement process for these to be the IS auditors first concern.