CISA Change Management Controls 2

Question 1

An IS auditor discovers that emergency changes are being applied directly to production without post-implementation review. What is the PRIMARY risk?

Accepted Answer

Unauthorized or erroneous changes may persist without detection

Answer

Emergency changes are inherently too risky to permit

Answer

Developers gain permanent elevated privileges

Answer

Change advisory boards become unnecessary

Question 2

Which document formally records the expected and actual outcomes of a system change, supporting rollback decisions?

Accepted Answer

Post-implementation review report

Answer

Change request form

Answer

Business impact analysis

Answer

Configuration management database

Question 3

A change management policy requires that all code changes be reviewed by a developer other than the author. This control PRIMARILY addresses which risk?

Accepted Answer

Unauthorized or fraudulent code being introduced

Answer

System downtime during deployment

Answer

Insufficient test environment resources

Answer

Inadequate change documentation

Question 4

In a change management process, the configuration management database (CMDB) is BEST used to:

Accepted Answer

Track relationships and dependencies between IT components

Answer

Store user acceptance test scripts

Answer

Manage change advisory board schedules

Answer

Record post-implementation review findings

Question 5

An auditor finds that the change management log shows 40% of changes classified as 'emergency' over the past quarter. What should the auditor conclude FIRST?

Accepted Answer

The classification criteria for emergency changes may be too broad or misused

Answer

Emergency change procedures are working effectively

Answer

The organization is experiencing unusually high system instability

Answer

Emergency changes should be eliminated entirely

Question 6

Which change management control BEST ensures that production libraries are only updated by authorized personnel?

Accepted Answer

Version control system with role-based access controls

Answer

Mandatory change request forms for all modifications

Answer

Regular change advisory board meetings

Answer

Automated change scheduling tools

Question 7

During an audit, an IS auditor verifies that all changes go through a test environment before production. What additional control should the auditor look for?

Accepted Answer

That the test environment is identical or representative of production

Answer

That end users perform all testing activities

Answer

That testing is completed within 24 hours

Answer

That the CMDB is updated during testing