The greatest concern for an IS auditor is when the network discovery scan detects systems that are not in the asset inventory. This indicates that there may be unauthorized or untracked devices on the network, which could pose security risks. These systems might not have proper security controls or monitoring in place, making them potential entry points for attacks or vulnerabilities.

https://teamhub.com/blog/creating-an-effective-project-management-dashboard/

The auditor's first course of action should be to consult the organization's acceptable use policy (AUP) to determine whether cryptocurrency mining is permitted or violates organizational rules.
This establishes a clear understanding of the organization's stance on the activity and informs the appropriate next steps. Without reviewing the policy, it is premature to report the incident or recommend changes.

Earned value analysis integrates scope, schedule and cost data to reveal variances between planned and actual performance. Without regular EVA, the project team lacks an objective measure of schedule and cost variances, so overruns can go unnoticed until they become severe.