CISA Change Management Controls 5

Question 1

An IS auditor is evaluating whether change management controls adequately protect against insider threats. The MOST effective control is:

Accepted Answer

Enforcing dual authorization for high-impact production changes

Answer

Dual authorization requires two authorized individuals to approve or execute high-impact changes, significantly reducing the ability of a single insider to cause harm.

Question 2

A company migrates to a cloud platform where the provider manages infrastructure changes. The IS auditor should verify that:

Accepted Answer

The company's SLA includes notification and communication of provider-side changes

Answer

SLA provisions for change notification ensure that cloud provider-initiated changes do not surprise the organization or violate agreed service expectations.

Question 3

An organization's change management policy states that all changes must have a business justification. What risk does this control PRIMARILY mitigate?

Accepted Answer

Unnecessary or unauthorized changes that increase system complexity and risk

Answer

Requiring business justification prevents changes that lack a legitimate purpose, reducing system complexity, attack surface, and unnecessary operational risk.

Question 4

Which of the following change management artifacts provides the BEST evidence for an IS audit of compliance with approved procedures?

Accepted Answer

Completed change tickets with approval signatures and test results

Answer

Complete change tickets with documented approvals and test results provide direct evidence that each change followed the required authorization and validation steps.

Question 5

During testing of a change management process, an IS auditor selects a sample of changes and finds that 15% have no evidence of user acceptance testing (UAT). The auditor should:

Accepted Answer

Determine whether those changes required UAT per policy and assess the impact

Answer

The auditor must assess whether policy required UAT for those specific changes and evaluate the risk created by omitting it before drawing a conclusion about materiality.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Change Management Controls 5