An IS auditor reviewing an organization's change management process discovers that emergency changes are not subject to the same testing and approval procedures as standard changes. Which of the following is the MOST important compensating control for the auditor to verify?
-
A
Emergency changes are approved by the appropriate level of management.
-
B
A log of all emergency changes is maintained and reviewed by the Change Advisory Board (CAB).
-
C
A post-implementation review of the emergency change is conducted to ensure it was properly implemented and documented.
-
D
The individual implementing the emergency change is different from the one who requested it.