ISACA Certified Information Systems Auditor (CISA) ExamDomain 1: Information System Auditing ProcessMedium
An IS auditor is reviewing an organization's change management process for critical production systems. The auditor discovers that emergency changes are frequently implemented without prior testing in a non-production environment. Which of the following audit procedures would be MOST effective in assessing the impact and control effectiveness of these emergency changes?
- ABenchmarking the organization's change management process against industry best practices.
- BReviewing incident reports and problem logs for systems affected by recent emergency changes.
- CInterviewing senior management about their risk tolerance for untested changes.
- DExamining training records for IT staff involved in implementing emergency changes.
Show answer & explanationAnswer & explanation
Correct answer: B. Reviewing incident reports and problem logs for systems affected by recent emergency changes.
To assess the impact and control effectiveness of emergency changes implemented without prior testing, reviewing incident reports and problem logs directly reveals whether these changes are causing issues or failures in the production environment. This provides direct evidence of the control's failure to prevent adverse effects.
Why the other options are wrong
- A. Benchmarking helps identify gaps in process design but doesn't directly assess the *impact* or *control effectiveness* of specific changes already made.
- C. Management's risk tolerance is a policy matter, but it doesn't directly assess the *impact* or *effectiveness* of the changes themselves.
- D. Training records indicate staff competence but don't directly show the *impact* or *effectiveness* of the changes themselves on the system.
Audit Procedure - Evidence Gathering
Techniques used by auditors to collect sufficient, reliable, relevant, and useful evidence to support audit findings and conclusions.
- Includes interviews, observation, inspection, and re-performance.
- Evidence must be directly related to the audit objective.
- The type of evidence dictates its reliability and persuasiveness.
Memory trick: To see if controls work, look at the results they produce.