CISA Change Management Controls 2

Question 1

An IS auditor discovers that emergency changes are being applied directly to production without post-implementation review. What is the PRIMARY risk?

Accepted Answer

Unauthorized or erroneous changes may persist without detection

Answer

Without post-implementation review, emergency changes that introduce errors or unauthorized modifications may remain undetected indefinitely.

Question 2

Which document formally records the expected and actual outcomes of a system change, supporting rollback decisions?

Accepted Answer

Post-implementation review report

Answer

A post-implementation review report compares expected outcomes with actual results and determines whether rollback or remediation is needed.

Question 3

A change management policy requires that all code changes be reviewed by a developer other than the author. This control PRIMARILY addresses which risk?

Accepted Answer

Unauthorized or fraudulent code being introduced

Answer

Peer code review provides separation of duties, reducing the risk that a single developer could introduce malicious or erroneous code undetected.

Question 4

In a change management process, the configuration management database (CMDB) is BEST used to:

Accepted Answer

Track relationships and dependencies between IT components

Answer

The CMDB tracks configuration items and their interdependencies, helping assess the potential impact of proposed changes.

Question 5

An auditor finds that the change management log shows 40% of changes classified as 'emergency' over the past quarter. What should the auditor conclude FIRST?

Accepted Answer

The classification criteria for emergency changes may be too broad or misused

Answer

A high proportion of emergency changes suggests that standard change controls may be routinely bypassed by misclassifying changes, warranting further investigation.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Change Management Controls 2