Question

During an audit of the change management process, an IS auditor interviews the change manager, who states that all emergency changes are reviewed and approved by the Change Advisory Board (CAB) within 48 hours after implementation. What should the auditor do NEXT to support a conclusion on this control?

Accepted Answer

Select a sample of emergency changes and inspect CAB records to corroborate the assertion

Answer

Document the change manager's statement as evidence that the control operates effectively

Answer

Recommend that the emergency change control be strengthened with automated approvals

Answer

Rely on the change manager's experience and issue a favorable opinion on the control