ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is reviewing the change management process for a critical production system. The auditor notes that emergency changes are implemented without prior testing, with testing occurring only after the change is live. Which of the following is the MOST appropriate recommendation for the IS auditor to make?
- ADevelop a rollback plan for all emergency changes in case of unexpected issues.
- BImplement a post-implementation review process for all emergency changes to assess impact.
- CRequire management approval for all emergency changes before they are deployed.
- DAll emergency changes must be fully tested in a dedicated test environment before implementation.
Show answer & explanationAnswer & explanation
Correct answer: D. All emergency changes must be fully tested in a dedicated test environment before implementation.
Implementing emergency changes without prior testing significantly increases the risk of introducing errors or system instability into a critical production environment. While other options are good practices, ensuring testing before deployment is paramount to prevent immediate negative impacts.
Why the other options are wrong
- A. A rollback plan is a good risk mitigation strategy, but it's a fallback, not a preventative measure against introducing errors from untested changes.
- B. A post-implementation review is important but does not prevent errors from entering production. It's reactive, not proactive.
- C. Management approval ensures authorization but does not address the technical risk of untested changes.
Emergency Change Control
Emergency change control refers to the process for managing urgent, unplanned changes to a system that must be implemented quickly to resolve critical issues.
- Requires expedited approval and implementation.
- Risk of bypassing standard procedures is high.
- Post-implementation review is crucial.
Memory trick: Act Fast, Test First, Stay Safe.