- A developer can promote her own code to production. Which control principle is missing?
Answer: Segregation of duties
Promoting code to production is a separate duty from writing it; allowing the same person to do both removes the independent check on what gets deployed. The closest wrong choice is least privilege access, which limits what someone can reach, but it doesn't address the conflict of an author approving her own change.
- A company's version control system shows that a critical configuration file was modified directly in production by a database administrator, with no corresponding change request. The auditor should classify this finding as:
Answer: A control deficiency - a change was made to production without authorization documentation, bypassing change management controls regardless of the individual's access level.
Having technical access to make a change does not constitute authorization. Changes to production systems require documented change requests regardless of the individual's role or access level. This is a control deficiency. Answer C is correct. Access rights (A), perceived minor impact (B), and verbal explanations (D) do not substitute for documented change management compliance.
- Post-implementation review (PIR) of an IT change is conducted primarily to:
Answer: Assess whether the change achieved its objectives, identify any issues, and capture lessons learned to improve future changes.
A PIR evaluates whether the change delivered its intended benefits, identifies residual issues, and produces lessons learned to continuously improve the change management process. Answer D is correct. Assigning blame (A), retroactively questioning CAB decisions (B), and financial accounting (C) are not the primary purposes of a PIR.
- Which of the following is the primary benefit of using a version control system with branching strategies (such as feature branches) in software development?
Answer: Developers can work on new features in isolation without affecting the stable main codebase, and changes are only merged after review and testing.
Branching allows parallel development in isolated environments, protecting the stable codebase while enabling code review and testing before merging - a key practice in controlled software development. Answer A is correct. Shared single-version development (B) is the older, riskier model. Automatic production updates (C) bypass controls. Version control does not replace testing (D).
- Which of the following represents a key detective control in an IT change management framework?
Answer: Comparing actual changes in production to the approved change request log to identify unauthorized modifications.
Comparing production changes against the approved change log is a detective control - it identifies changes that occurred without authorization after the fact. Answer D is correct. CAB approval (A), automated pipelines (B), and role separation (C) are all preventive controls.
- Which of the following best describes 'change freeze' periods in IT operations?
Answer: Defined periods (often around major financial reporting dates or peak business times) during which non-emergency changes to critical systems are prohibited to reduce risk.
Change freezes restrict non-emergency changes during high-risk periods (year-end close, peak sales seasons) to prevent disruptions when system stability is most critical. Answer D is correct. Vacation restrictions (A), infrastructure upgrades (B), and system maintenance (C) are unrelated to change freezes.
- Which of the following best describes a 'rollback plan' in the context of change management?
Answer: A documented procedure to reverse a change and restore the system to its prior stable state if the change causes problems.
A rollback plan defines the steps to undo a change and restore the system to its previous working state if the change fails or causes unacceptable issues. Answer C is correct. Rollback refers to system restoration, not personnel actions (A), financial recovery (B), or deployment strategy (D).
- Which of the following represents an IT general control weakness related to change management that could directly affect the reliability of financial reporting?
Answer: Unauthorized changes to the general ledger application that alter transaction processing logic, producing incorrect financial data.
Unauthorized changes to financial applications can directly corrupt transaction processing and financial data, affecting the reliability of financial reporting. This is why program change controls are a focus of financial statement audits. Answer A is correct. Email delays (B), strategic plan updates (C), and non-financial system vulnerabilities (D) do not directly affect financial reporting reliability.
- An organization's change management policy requires that all changes go through a formal request, approval, testing, and deployment process. A developer argues that a 'minor' configuration change does not need to follow this process. The most appropriate response is:
Answer: Require the change to follow the formal process, as all changes - regardless of perceived size - must be controlled to prevent unauthorized modifications.
All changes, including those perceived as minor, must follow the formal process. 'Minor' changes have caused significant outages and fraud schemes. Exceptions undermine the control environment. Answer C is correct. Agreeing to bypass controls (A), verbal-only approval (B), and informal parallel processes (D) all weaken change management controls.
- Which of the following change management controls would most effectively prevent unauthorized program changes from being migrated to the production environment?
Answer: Implementing automated deployment pipelines that only allow changes with completed approvals in the change management system to be deployed to production.
Automated deployment pipelines enforce change management as a technical control - changes cannot be deployed to production unless the corresponding approval workflow is completed, making the control both efficient and reliable. Answer B is correct. Personal logs (A) and quarterly reviews (C) are detective, not preventive. Training (D) is a soft control that relies on compliance.
- An auditor reviewing IT change management discovers that the same person who develops code is also responsible for approving and migrating changes to production. This situation represents:
Answer: A segregation of duties deficiency that increases the risk of unauthorized or erroneous changes reaching production.
Having one person develop, approve, and deploy changes eliminates segregation of duties - a fundamental control that reduces the risk of fraud and errors. This is a control deficiency regardless of team size or individual seniority. Answer B is correct. While DevOps practices (A) may streamline processes, they still require compensating controls. Small teams (C) and seniority (D) do not eliminate the control risk.
- An emergency production fix skips normal approval. What must happen next?
Answer: Retroactive approval and log
An emergency fix still needs the same controls after the fact, so you obtain retroactive approval and document what was done. The tempting mistake is to think you must roll back immediately; rollback is only if the fix fails or is unsafe, not the required follow-up for skipping approval.
- In the context of IT general controls, program change controls are designed to:
Answer: Ensure that only authorized, tested, and properly approved changes are made to production application programs.
Program change controls are a category of IT general controls (ITGCs) that govern the authorization, testing, and migration of application changes to production. Answer D is correct. Network monitoring (A), license management (B), and asset tracking (C) are separate IT control domains.
- During an IT audit, an auditor finds that a significant system change was implemented in the production environment without a corresponding change request record. This finding most likely indicates:
Answer: A control deficiency - the change was made without proper authorization and documentation, bypassing the change management process.
A production change with no corresponding change request record indicates the change management process was bypassed, which is a control deficiency regardless of the change's technical merits. Answer D is correct. Without documentation, the auditor cannot assume authorization (A), system malfunction (B), or emergency status (C) without additional evidence.
- The primary purpose of a formal change management process in IT is to:
Answer: Ensure that changes to IT systems are authorized, tested, and implemented in a controlled manner to minimize risk and disruption.
Change management provides a structured process for evaluating, approving, testing, and implementing changes, reducing the risk of unauthorized changes, system instability, and operational disruption. Answer B is correct. Eliminating testing (A) would increase risk. Documenting every action (C) describes logging, not change management. Preventing user requests (D) is not a change management objective.
- The concept of 'release management' in IT operations is most closely related to:
Answer: Planning, scheduling, and controlling the deployment of software releases to the production environment in a coordinated and controlled manner.
Release management is the IT process of planning and coordinating the deployment of software versions to production, ensuring that multiple changes are packaged, tested, and deployed in a controlled and orderly fashion. Answer B is correct. Financial budgeting (A), policy publishing (C), and HR processes (D) are unrelated to release management.
- In a well-controlled IT environment, which of the following best describes appropriate segregation of duties in the change management process?
Answer: The individuals who develop and test changes should be different from the individuals who approve and deploy changes to production.
Segregation of duties in change management requires separation of development, testing, approval, and deployment functions to prevent any one person from controlling an entire change lifecycle, reducing fraud and error risk. Answer C is correct. Having one person perform all steps (A, B) eliminates effective segregation. Business user involvement (D) is important for requirements and acceptance testing.
- Two programmers edit the same module concurrently. What prevents lost updates?
Answer: Locking or merge detection
Lost updates happen when two programmers overwrite each other's changes. Locking prevents concurrent edits to the same module, while merge detection compares versions and flags conflicts before either update is lost. The tempting wrong answer is compile-time error reports, but those only catch syntax or type problems after code is already written, not race conditions between edits.
- A company's development team uses a 'continuous integration/continuous deployment' (CI/CD) pipeline. From a controls perspective, what is most important to ensure in this environment?
Answer: Automated testing, code reviews, and approval gates must be embedded in the pipeline to maintain change management controls despite the rapid deployment cadence.
CI/CD accelerates deployment, so controls must be embedded in the pipeline itself - automated tests, peer code reviews, and approval gates - rather than relying on manual processes that cannot keep pace. Answer B is correct. Disabling CI/CD periodically (A) disrupts business. External auditor pre-review (C) is impractical. Limiting CI/CD to development only (D) defeats its purpose.
- When auditing program change controls, which of the following procedures would provide the most direct evidence that unauthorized changes are not being made to production?
Answer: Selecting a sample of production changes and tracing each to a corresponding approved change request and test evidence.
Tracing production changes to approved change requests and test documentation is the most direct audit procedure for verifying that changes are authorized and tested. Answer C is correct. Org chart review (A) and management interviews (B) provide indirect evidence. Disaster recovery plans (D) address recovery, not change authorization.
