CPA Isc Quiz: Assess Change Management And Version Control

What this quiz covers

This quiz focuses on Assess Change Management And Version Control, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Reduce the cost of software development by eliminating testing phases.
2. Ensure that changes to IT systems are authorized, tested, and implemented in a controlled manner to minimize risk and disruption. (correct answer)
3. Require all IT staff to document every action they take in production systems.
4. Prevent end users from requesting new system features or enhancements.

Explanation: Change management provides a structured process for evaluating, approving, testing, and implementing changes, reducing the risk of unauthorized changes, system instability, and operational disruption. Answer B is correct. Eliminating testing (A) would increase risk. Documenting every action (C) describes logging, not change management. Preventing user requests (D) is not a change management objective.

Question 2

1. Implement the change immediately without documentation to minimize the window of vulnerability.
2. Wait for the next scheduled change window, even if it is weeks away, to follow standard procedures.
3. Allow any available IT staff member to make the change without approval to save time.
4. Implement the change with expedited approval from authorized management, followed by full documentation and post-implementation review. (correct answer)

Explanation: Emergency changes require rapid action but should still receive authorization from appropriate management, followed by complete documentation and review after implementation to maintain control. Answer D is correct. Skipping documentation entirely (A) and unlimited authorization (C) bypass controls. Waiting weeks for a critical patch (B) leaves the organization exposed.

Question 3

1. Developers can work on new features in isolation without affecting the stable main codebase, and changes are only merged after review and testing. (correct answer)
2. All developers share a single version of the code at all times, ensuring no conflicts arise.
3. The production environment automatically receives updates as soon as code is committed.
4. Version control systems eliminate the need for formal testing before deployment.

Explanation: Branching allows parallel development in isolated environments, protecting the stable codebase while enabling code review and testing before merging - a key practice in controlled software development. Answer A is correct. Shared single-version development (B) is the older, riskier model. Automatic production updates (C) bypass controls. Version control does not replace testing (D).

Question 4

1. Monitor network traffic for unauthorized access to application servers.
2. Ensure that software licenses are renewed before they expire.
3. Track the physical location of all IT hardware assets.
4. Ensure that only authorized, tested, and properly approved changes are made to production application programs. (correct answer)

Explanation: Program change controls are a category of IT general controls (ITGCs) that govern the authorization, testing, and migration of application changes to production. Answer D is correct. Network monitoring (A), license management (B), and asset tracking (C) are separate IT control domains.

Question 5

1. Periods during which all IT staff are prohibited from taking vacation.
2. Scheduled times when the IT infrastructure undergoes major upgrades.
3. Periods when the change management system is offline for maintenance.
4. Defined periods (often around major financial reporting dates or peak business times) during which non-emergency changes to critical systems are prohibited to reduce risk. (correct answer)

Explanation: Change freezes restrict non-emergency changes during high-risk periods (year-end close, peak sales seasons) to prevent disruptions when system stability is most critical. Answer D is correct. Vacation restrictions (A), infrastructure upgrades (B), and system maintenance (C) are unrelated to change freezes.

Question 6

1. Failure of the change management process to require and enforce testing before production deployment. (correct answer)
2. Failure of the data backup system to preserve the original module.
3. Failure of the network security team to detect the unauthorized deployment.
4. Failure of the internal audit function to review the change after deployment.

Explanation: The root cause is the change management control failure - the process did not enforce the testing requirement before production deployment. Answer A is correct. Backup failure (B) is a recovery issue. Network security (C) detects intrusions, not testing failures. Internal audit (D) is a review function, not a preventive control.

Question 7

1. Unauthorized or untested changes could be introduced into production, potentially causing system errors, data corruption, or fraud. (correct answer)
2. Developers may become too familiar with the production environment, reducing their coding efficiency.
3. Production changes made by developers will automatically be reflected in the development environment.
4. The change management process will require more documentation to track developer activity.

Explanation: Allowing developers direct production access bypasses authorization, testing, and segregation of duties controls - creating significant risk of intentional or accidental introduction of harmful changes. Answer A is correct. The risks are substantive security and control risks, not efficiency (B) or documentation burden (D). Changes do not automatically sync between environments (C).

Question 8

1. Agree with the developer since minor changes present minimal risk.
2. Allow the developer to make the change but require verbal approval from a supervisor.
3. Require the change to follow the formal process, as all changes - regardless of perceived size - must be controlled to prevent unauthorized modifications. (correct answer)
4. Create a separate, informal process for minor changes that bypasses CAB review.

Explanation: All changes, including those perceived as minor, must follow the formal process. 'Minor' changes have caused significant outages and fraud schemes. Exceptions undermine the control environment. Answer C is correct. Agreeing to bypass controls (A), verbal-only approval (B), and informal parallel processes (D) all weaken change management controls.

Question 9

1. Identify which developer is responsible for any defects introduced by the change.
2. Determine whether the change request should have been rejected by the CAB.
3. Calculate the financial cost of implementing the change.
4. Assess whether the change achieved its objectives, identify any issues, and capture lessons learned to improve future changes. (correct answer)

Explanation: A PIR evaluates whether the change delivered its intended benefits, identifies residual issues, and produces lessons learned to continuously improve the change management process. Answer D is correct. Assigning blame (A), retroactively questioning CAB decisions (B), and financial accounting (C) are not the primary purposes of a PIR.

Question 10

1. Acceptable if the DBA has production access rights in the system.
2. A low-risk finding since configuration changes are typically minor.
3. A control deficiency - a change was made to production without authorization documentation, bypassing change management controls regardless of the individual's access level. (correct answer)
4. Not a finding if the DBA can provide a verbal explanation of the change.

Explanation: Having technical access to make a change does not constitute authorization. Changes to production systems require documented change requests regardless of the individual's role or access level. This is a control deficiency. Answer C is correct. Access rights (A), perceived minor impact (B), and verbal explanations (D) do not substitute for documented change management compliance.

Question 11

1. Unauthorized changes to the general ledger application that alter transaction processing logic, producing incorrect financial data. (correct answer)
2. A delay in upgrading the organization's email system.
3. Failure to update the IT strategic plan on an annual basis.
4. An unpatched vulnerability in a non-financial system.

Explanation: Unauthorized changes to financial applications can directly corrupt transaction processing and financial data, affecting the reliability of financial reporting. This is why program change controls are a focus of financial statement audits. Answer A is correct. Email delays (B), strategic plan updates (C), and non-financial system vulnerabilities (D) do not directly affect financial reporting reliability.

Question 12

1. Standard changes require more extensive testing and CAB approval than normal changes.
2. Standard changes can only be made by senior IT managers.
3. Standard changes are pre-approved, low-risk, routine changes with well-established procedures that do not require individual CAB review each time. (correct answer)
4. Standard changes are limited to hardware replacements and do not include software modifications.

Explanation: Standard changes are pre-approved categories of routine, low-risk changes (e.g., password resets, standard software installs) that follow predefined procedures and do not need individual CAB review for each occurrence. Answer C is correct. Standard changes require less oversight, not more (A). Any authorized staff can execute them (B). They can cover software and hardware (D).

Question 13

1. Requiring written approval from the CAB before any change is implemented.
2. Implementing automated deployment pipelines that enforce change approvals.
3. Separating developer and production administrator roles.
4. Comparing actual changes in production to the approved change request log to identify unauthorized modifications. (correct answer)

Explanation: Comparing production changes against the approved change log is a detective control - it identifies changes that occurred without authorization after the fact. Answer D is correct. CAB approval (A), automated pipelines (B), and role separation (C) are all preventive controls.

Question 14

1. User acceptance testing (UAT) should only be performed after the change has been live in production for one week.
2. Unit testing, integration testing, and user acceptance testing (UAT) should all be completed in non-production environments before production deployment. (correct answer)
3. Testing is not required for changes that have been approved by the CAB.
4. Only security testing is required before production deployment; functionality testing can occur post-deployment.

Explanation: Best practice requires progressive testing - unit, integration, and UAT - all completed in test/staging environments before production deployment to minimize the risk of defects or disruptions. Answer B is correct. Post-production testing (A) and no testing for CAB-approved changes (C) are inadequate. Testing all dimensions before deployment (D) is incomplete.

Question 15

1. Reviewing the IT department's organizational chart to verify segregation of duties.
2. Interviewing the CIO about the change management policy.
3. Selecting a sample of production changes and tracing each to a corresponding approved change request and test evidence. (correct answer)
4. Reviewing the disaster recovery plan for evidence of change management procedures.

Explanation: Tracing production changes to approved change requests and test documentation is the most direct audit procedure for verifying that changes are authorized and tested. Answer C is correct. Org chart review (A) and management interviews (B) provide indirect evidence. Disaster recovery plans (D) address recovery, not change authorization.

Question 16

1. Requiring developers to maintain personal logs of all code changes they make.
2. Implementing automated deployment pipelines that only allow changes with completed approvals in the change management system to be deployed to production. (correct answer)
3. Conducting post-implementation reviews of all changes on a quarterly basis.
4. Training all IT staff on the importance of following change management procedures.

Explanation: Automated deployment pipelines enforce change management as a technical control - changes cannot be deployed to production unless the corresponding approval workflow is completed, making the control both efficient and reliable. Answer B is correct. Personal logs (A) and quarterly reviews (C) are detective, not preventive. Training (D) is a soft control that relies on compliance.

Question 17

1. The developer who writes code should also perform user acceptance testing and deploy to production.
2. A single IT administrator should control all change management activities to ensure consistency.
3. The individuals who develop and test changes should be different from the individuals who approve and deploy changes to production. (correct answer)
4. Business users should not be involved in any stage of the change management process.

Explanation: Segregation of duties in change management requires separation of development, testing, approval, and deployment functions to prevent any one person from controlling an entire change lifecycle, reducing fraud and error risk. Answer C is correct. Having one person perform all steps (A, B) eliminates effective segregation. Business user involvement (D) is important for requirements and acceptance testing.

Question 18

1. Encrypting source code to prevent unauthorized access by external parties.
2. Tracking changes to source code over time, enabling rollback to prior versions and supporting collaborative development. (correct answer)
3. Automatically deploying code changes to the production environment upon completion.
4. Monitoring the performance of production applications in real time.

Explanation: Version control systems maintain a history of all code changes, who made them, and when, enabling rollback to stable versions and supporting multiple developers working concurrently. Answer B is correct. Encryption (A), automatic deployment (C), and performance monitoring (D) are separate tools and processes.

Question 19

1. Maintain an accurate inventory of IT assets (configuration items) and their relationships to support change management and incident resolution. (correct answer)
2. Store encrypted backup copies of the organization's databases.
3. Track software license compliance for all installed applications.
4. Monitor real-time network traffic for security threats.

Explanation: A CMDB is a repository of information about IT configuration items (hardware, software, services) and their interdependencies, providing the foundation for informed change management decisions. Answer A is correct. Encrypted backups (B), license tracking (C), and network monitoring (D) are separate systems and functions.

Question 20

1. The CI/CD pipeline should be disabled during financial reporting periods to prevent unauthorized changes.
2. Automated testing, code reviews, and approval gates must be embedded in the pipeline to maintain change management controls despite the rapid deployment cadence. (correct answer)
3. All CI/CD deployments should be reviewed by external auditors before going live.
4. The CI/CD pipeline should only be used for development environment deployments, never for production.

Explanation: CI/CD accelerates deployment, so controls must be embedded in the pipeline itself - automated tests, peer code reviews, and approval gates - rather than relying on manual processes that cannot keep pace. Answer B is correct. Disabling CI/CD periodically (A) disrupts business. External auditor pre-review (C) is impractical. Limiting CI/CD to development only (D) defeats its purpose.