CISA Change Management Controls 2 — Questions and Answers
Question 1: An IS auditor discovers that emergency changes are being applied directly to production without post-implementation review. What is the PRIMARY risk?
- Emergency changes are inherently too risky to permit
- Unauthorized or erroneous changes may persist without detection (Correct answer)
- Developers gain permanent elevated privileges
- Change advisory boards become unnecessary
Correct answer: Unauthorized or erroneous changes may persist without detection
Without post-implementation review, emergency changes that introduce errors or unauthorized modifications may remain undetected indefinitely.
Question 2: Which document formally records the expected and actual outcomes of a system change, supporting rollback decisions?
- Change request form
- Business impact analysis
- Post-implementation review report (Correct answer)
- Configuration management database
Correct answer: Post-implementation review report
A post-implementation review report compares expected outcomes with actual results and determines whether rollback or remediation is needed.
Question 3: A change management policy requires that all code changes be reviewed by a developer other than the author. This control PRIMARILY addresses which risk?
- System downtime during deployment
- Unauthorized or fraudulent code being introduced (Correct answer)
- Insufficient test environment resources
- Inadequate change documentation
Correct answer: Unauthorized or fraudulent code being introduced
Peer code review provides separation of duties, reducing the risk that a single developer could introduce malicious or erroneous code undetected.
Question 4: In a change management process, the configuration management database (CMDB) is BEST used to:
- Store user acceptance test scripts
- Track relationships and dependencies between IT components (Correct answer)
- Manage change advisory board schedules
- Record post-implementation review findings
Correct answer: Track relationships and dependencies between IT components
The CMDB tracks configuration items and their interdependencies, helping assess the potential impact of proposed changes.
Question 5: An auditor finds that the change management log shows 40% of changes classified as 'emergency' over the past quarter. What should the auditor conclude FIRST?
- Emergency change procedures are working effectively
- The classification criteria for emergency changes may be too broad or misused (Correct answer)
- The organization is experiencing unusually high system instability
- Emergency changes should be eliminated entirely
Correct answer: The classification criteria for emergency changes may be too broad or misused
A high proportion of emergency changes suggests that standard change controls may be routinely bypassed by misclassifying changes, warranting further investigation.
Question 6: Which change management control BEST ensures that production libraries are only updated by authorized personnel?
- Version control system with role-based access controls (Correct answer)
- Mandatory change request forms for all modifications
- Regular change advisory board meetings
- Automated change scheduling tools
Correct answer: Version control system with role-based access controls
Role-based access controls on version control systems restrict who can commit or deploy code, directly enforcing authorization requirements.
Question 7: During an audit, an IS auditor verifies that all changes go through a test environment before production. What additional control should the auditor look for?
- That the test environment is identical or representative of production (Correct answer)
- That end users perform all testing activities
- That testing is completed within 24 hours
- That the CMDB is updated during testing
Correct answer: That the test environment is identical or representative of production
If the test environment does not adequately mirror production, testing results may not predict production behavior, undermining the control.
CISA Change Management Controls 2
An IS auditor discovers that emergency changes are being applied directly to production without post-implementation review.
What is the PRIMARY risk?