CISA - Certified Information Systems Auditor Change Management Controls Questions and Answers — Questions and Answers
Question 1: An IS auditor reviewing an organization's change management process discovers that emergency changes are not subject to the same testing and approval procedures as standard changes. Which of the following is the MOST important compensating control for the auditor to verify?
- Emergency changes are approved by the appropriate level of management.
- A log of all emergency changes is maintained and reviewed by the Change Advisory Board (CAB).
- A post-implementation review of the emergency change is conducted to ensure it was properly implemented and documented. (Correct answer)
- The individual implementing the emergency change is different from the one who requested it.
Correct answer: A post-implementation review of the emergency change is conducted to ensure it was properly implemented and documented.
While all other options are good controls, the most critical compensating control for bypassing standard testing and approval is a post-implementation review. This review verifies that the emergency change resolved the issue, was implemented correctly, did not introduce new vulnerabilities, and is fully documented after the fact.
Question 2: During a review of a software development project, an IS auditor is most concerned about the lack of segregation of duties. Which of the following scenarios represents the GREATEST risk?
- A developer has access to both the development and testing environments.
- A quality assurance analyst can request changes to the production environment.
- A project manager can approve their own changes to the project plan.
- A developer can migrate their own code from the development environment to the production environment. (Correct answer)
Correct answer: A developer can migrate their own code from the development environment to the production environment.
This scenario presents the highest risk because it allows a developer to introduce unauthorized, untested, or malicious code directly into the live production environment without any independent oversight or testing. This bypasses critical controls and could lead to significant system failure, data breaches, or fraud.
Question 3: Which of the following is the PRIMARY objective of a rollback plan in the change management process?
- To ensure changes are properly documented for future audits.
- To provide a quick recovery mechanism in case of a failed implementation. (Correct answer)
- To schedule the change during a low-impact maintenance window.
- To obtain formal approval from business stakeholders before deployment.
Correct answer: To provide a quick recovery mechanism in case of a failed implementation.
The primary purpose of a rollback plan is to provide a tested and documented procedure for reverting a system to its previous stable state if a change implementation fails or causes unforeseen critical issues. This minimizes downtime and business impact.
Question 4: An IS auditor is evaluating the change management process for a critical financial application. To ensure the integrity of the production environment, the auditor should verify that:
- all changes are categorized by risk and priority.
- the Change Advisory Board (CAB) includes business representation.
- access to migrate changes into production is restricted to an independent group. (Correct answer)
- end-user training is completed before changes are deployed.
Correct answer: access to migrate changes into production is restricted to an independent group.
Restricting access to migrate changes into the production environment to an independent group (e.g., a release management or operations team) is a fundamental control. This enforces segregation of duties, preventing developers from promoting their own, potentially flawed or unauthorized, code into the live environment.
Question 5: A small organization has limited IT staff, making strict segregation of duties within the change management process difficult. Which of the following is the BEST compensating control an IS auditor should recommend?
- Implementing a fully automated change deployment tool.
- Requiring all changes to be approved by the CEO.
- Conducting independent event log and activity monitoring. (Correct answer)
- Cross-training all IT staff on change management procedures.
Correct answer: Conducting independent event log and activity monitoring.
When segregation of duties is not feasible, a strong compensating control is independent monitoring and review of activities. Regularly reviewing detailed event logs and user activity can detect unauthorized or improper changes made by staff who may have conflicting permissions.
Question 6: An IS auditor is reviewing the change request documentation for a recently implemented system upgrade. Which of the following pieces of evidence provides the BEST assurance that the change was successful and met business requirements?
- A signed change request form from the IT manager.
- A screenshot of the successful code compilation log.
- User Acceptance Testing (UAT) results signed off by the business process owner. (Correct answer)
- A completion email from the lead developer.
Correct answer: User Acceptance Testing (UAT) results signed off by the business process owner.
User Acceptance Testing (UAT) results, formally signed off by the business owner, provide the strongest evidence that the change not only works technically but also meets the functional requirements and is fit for purpose from a business perspective. The other options only confirm parts of the IT process, not the business outcome.
CISA - Certified Information Systems Auditor Change Management Controls Questions and Answers
An IS auditor reviewing an organization's change management process discovers that emergency changes are not subject to the same testing and approval procedures as standard changes.
Which of the following is the MOST important compensating control for the auditor to verify?