CISA - Certified Information Systems Auditor Change Management Controls Questions and Answers

Question 1

An IS auditor reviewing an organization's change management process discovers that emergency changes are not subject to the same testing and approval procedures as standard changes.
Which of the following is the MOST important compensating control for the auditor to verify?

Accepted Answer

A post-implementation review of the emergency change is conducted to ensure it was properly implemented and documented.

Answer

Emergency changes are approved by the appropriate level of management.

Answer

A log of all emergency changes is maintained and reviewed by the Change Advisory Board (CAB).

Answer

The individual implementing the emergency change is different from the one who requested it.

Question 2

During a review of a software development project, an IS auditor is most concerned about the lack of segregation of duties. Which of the following scenarios represents the GREATEST risk?

Accepted Answer

A developer can migrate their own code from the development environment to the production environment.

Answer

A developer has access to both the development and testing environments.

Answer

A quality assurance analyst can request changes to the production environment.

Answer

A project manager can approve their own changes to the project plan.

Question 3

Which of the following is the PRIMARY objective of a rollback plan in the change management process?

Accepted Answer

To provide a quick recovery mechanism in case of a failed implementation.

Answer

To ensure changes are properly documented for future audits.

Answer

To schedule the change during a low-impact maintenance window.

Answer

To obtain formal approval from business stakeholders before deployment.

Question 4

An IS auditor is evaluating the change management process for a critical financial application. To ensure the integrity of the production environment, the auditor should verify that:

Accepted Answer

access to migrate changes into production is restricted to an independent group.

Answer

all changes are categorized by risk and priority.

Answer

the Change Advisory Board (CAB) includes business representation.

Answer

end-user training is completed before changes are deployed.

Question 5

A small organization has limited IT staff, making strict segregation of duties within the change management process difficult. Which of the following is the BEST compensating control an IS auditor should recommend?

Accepted Answer

Conducting independent event log and activity monitoring.

Answer

Implementing a fully automated change deployment tool.

Answer

Requiring all changes to be approved by the CEO.

Answer

Cross-training all IT staff on change management procedures.

Question 6

An IS auditor is reviewing the change request documentation for a recently implemented system upgrade. Which of the following pieces of evidence provides the BEST assurance that the change was successful and met business requirements?

Accepted Answer

User Acceptance Testing (UAT) results signed off by the business process owner.

Answer

A signed change request form from the IT manager.

Answer

A screenshot of the successful code compilation log.

Answer

A completion email from the lead developer.