CPA Isc Quiz: Assess Change Management And Version Control
20 questions · exam conditions
0:00
Assess Change Management And Version ControlQuestion 1 of 20

An emergency production fix skips normal approval. What must happen next?

Rollback to the prior version
Retroactive approval and log
Notify every affected user
Recompile with debugging tools
← Back to quizzes

CPA Isc Quiz

CPA Isc Quiz: Assess Change Management And Version Control

Practice Assess Change Management And Version Control in CPA Isc with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Assess Change Management And Version Control, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An emergency production fix skips normal approval. What must happen next?

  1. Rollback to the prior version
  2. Retroactive approval and log (correct answer)
  3. Notify every affected user
  4. Recompile with debugging tools
Explanation: An emergency fix still needs the same controls after the fact, so you obtain retroactive approval and document what was done. The tempting mistake is to think you must roll back immediately; rollback is only if the fix fails or is unsafe, not the required follow-up for skipping approval.

Question 2

Two programmers edit the same module concurrently. What prevents lost updates?

  1. Compile-time error reports
  2. Daily full-system backups
  3. Read-only access for testers
  4. Locking or merge detection (correct answer)
Explanation: Lost updates happen when two programmers overwrite each other's changes. Locking prevents concurrent edits to the same module, while merge detection compares versions and flags conflicts before either update is lost. The tempting wrong answer is compile-time error reports, but those only catch syntax or type problems after code is already written, not race conditions between edits.

Question 3

Which control detects an unauthorized code change after promotion?

  1. Compare hash to approved build (correct answer)
  2. Weekly review of access logs
  3. Dual sign-off on release form
  4. Encrypting test source code
Explanation: Comparing the hash of the promoted code against the approved build hash directly reveals any unauthorized modification after promotion. A mismatch means the code that moved forward is not the code that was approved. The tempting weekly access-log review only shows who accessed systems, not whether the actual code content was changed; it is access monitoring, not code integrity verification.

Question 4

What is the main purpose of tagging a build as a release candidate?

  1. Encrypts stored source code
  2. Reduces total compile time
  3. Identifies the source version (correct answer)
  4. Automates end-user training
Explanation: Tagging a build as a release candidate marks the exact commit or source snapshot that produced it, so the team can later identify and reproduce that version. That's how tagging identifies the source version. The tempting wrong answer is that it reduces total compile time, but a tag is just a label in version control; it does nothing to speed up compilation.

Question 5

A developer can promote her own code to production. Which control principle is missing?

  1. Segregation of duties (correct answer)
  2. Least privilege access
  3. Defense-in-depth layers
  4. Continuous audit logging
Explanation: Promoting code to production is a separate duty from writing it; allowing the same person to do both removes the independent check on what gets deployed. The closest wrong choice is least privilege access, which limits what someone can reach, but it doesn't address the conflict of an author approving her own change.

Question 6

The primary purpose of a formal change management process in IT is to:

  1. Reduce the cost of software development by eliminating testing phases.
  2. Ensure that changes to IT systems are authorized, tested, and implemented in a controlled manner to minimize risk and disruption. (correct answer)
  3. Require all IT staff to document every action they take in production systems.
  4. Prevent end users from requesting new system features or enhancements.
Explanation: Change management provides a structured process for evaluating, approving, testing, and implementing changes, reducing the risk of unauthorized changes, system instability, and operational disruption. Answer B is correct. Eliminating testing (A) would increase risk. Documenting every action (C) describes logging, not change management. Preventing user requests (D) is not a change management objective.

Question 7

An emergency change is required to patch a critical security vulnerability in a production system. Which of the following represents the best practice for handling emergency changes?

  1. Implement the change immediately without documentation to minimize the window of vulnerability.
  2. Wait for the next scheduled change window, even if it is weeks away, to follow standard procedures.
  3. Allow any available IT staff member to make the change without approval to save time.
  4. Implement the change with expedited approval from authorized management, followed by full documentation and post-implementation review. (correct answer)
Explanation: Emergency changes require rapid action but should still receive authorization from appropriate management, followed by complete documentation and review after implementation to maintain control. Answer D is correct. Skipping documentation entirely (A) and unlimited authorization (C) bypass controls. Waiting weeks for a critical patch (B) leaves the organization exposed.

Question 8

Which of the following is the primary benefit of using a version control system with branching strategies (such as feature branches) in software development?

  1. Developers can work on new features in isolation without affecting the stable main codebase, and changes are only merged after review and testing. (correct answer)
  2. All developers share a single version of the code at all times, ensuring no conflicts arise.
  3. The production environment automatically receives updates as soon as code is committed.
  4. Version control systems eliminate the need for formal testing before deployment.
Explanation: Branching allows parallel development in isolated environments, protecting the stable codebase while enabling code review and testing before merging - a key practice in controlled software development. Answer A is correct. Shared single-version development (B) is the older, riskier model. Automatic production updates (C) bypass controls. Version control does not replace testing (D).

Question 9

In the context of IT general controls, program change controls are designed to:

  1. Monitor network traffic for unauthorized access to application servers.
  2. Ensure that software licenses are renewed before they expire.
  3. Track the physical location of all IT hardware assets.
  4. Ensure that only authorized, tested, and properly approved changes are made to production application programs. (correct answer)
Explanation: Program change controls are a category of IT general controls (ITGCs) that govern the authorization, testing, and migration of application changes to production. Answer D is correct. Network monitoring (A), license management (B), and asset tracking (C) are separate IT control domains.

Question 10

Which of the following best describes 'change freeze' periods in IT operations?

  1. Periods during which all IT staff are prohibited from taking vacation.
  2. Scheduled times when the IT infrastructure undergoes major upgrades.
  3. Periods when the change management system is offline for maintenance.
  4. Defined periods (often around major financial reporting dates or peak business times) during which non-emergency changes to critical systems are prohibited to reduce risk. (correct answer)
Explanation: Change freezes restrict non-emergency changes during high-risk periods (year-end close, peak sales seasons) to prevent disruptions when system stability is most critical. Answer D is correct. Vacation restrictions (A), infrastructure upgrades (B), and system maintenance (C) are unrelated to change freezes.

Question 11

A financial institution discovers that a change to its interest calculation module was deployed to production without any testing. The change contained a logic error that resulted in incorrect interest charges to customers. Which control failure is most directly responsible?

  1. Failure of the change management process to require and enforce testing before production deployment. (correct answer)
  2. Failure of the data backup system to preserve the original module.
  3. Failure of the network security team to detect the unauthorized deployment.
  4. Failure of the internal audit function to review the change after deployment.
Explanation: The root cause is the change management control failure - the process did not enforce the testing requirement before production deployment. Answer A is correct. Backup failure (B) is a recovery issue. Network security (C) detects intrusions, not testing failures. Internal audit (D) is a review function, not a preventive control.

Question 12

Which of the following is the most significant risk of allowing developers direct access to make changes in the production environment?

  1. Unauthorized or untested changes could be introduced into production, potentially causing system errors, data corruption, or fraud. (correct answer)
  2. Developers may become too familiar with the production environment, reducing their coding efficiency.
  3. Production changes made by developers will automatically be reflected in the development environment.
  4. The change management process will require more documentation to track developer activity.
Explanation: Allowing developers direct production access bypasses authorization, testing, and segregation of duties controls - creating significant risk of intentional or accidental introduction of harmful changes. Answer A is correct. The risks are substantive security and control risks, not efficiency (B) or documentation burden (D). Changes do not automatically sync between environments (C).

Question 13

An organization's change management policy requires that all changes go through a formal request, approval, testing, and deployment process. A developer argues that a 'minor' configuration change does not need to follow this process. The most appropriate response is:

  1. Agree with the developer since minor changes present minimal risk.
  2. Allow the developer to make the change but require verbal approval from a supervisor.
  3. Require the change to follow the formal process, as all changes - regardless of perceived size - must be controlled to prevent unauthorized modifications. (correct answer)
  4. Create a separate, informal process for minor changes that bypasses CAB review.
Explanation: All changes, including those perceived as minor, must follow the formal process. 'Minor' changes have caused significant outages and fraud schemes. Exceptions undermine the control environment. Answer C is correct. Agreeing to bypass controls (A), verbal-only approval (B), and informal parallel processes (D) all weaken change management controls.

Question 14

Post-implementation review (PIR) of an IT change is conducted primarily to:

  1. Identify which developer is responsible for any defects introduced by the change.
  2. Determine whether the change request should have been rejected by the CAB.
  3. Calculate the financial cost of implementing the change.
  4. Assess whether the change achieved its objectives, identify any issues, and capture lessons learned to improve future changes. (correct answer)
Explanation: A PIR evaluates whether the change delivered its intended benefits, identifies residual issues, and produces lessons learned to continuously improve the change management process. Answer D is correct. Assigning blame (A), retroactively questioning CAB decisions (B), and financial accounting (C) are not the primary purposes of a PIR.

Question 15

A company's version control system shows that a critical configuration file was modified directly in production by a database administrator, with no corresponding change request. The auditor should classify this finding as:

  1. Acceptable if the DBA has production access rights in the system.
  2. A low-risk finding since configuration changes are typically minor.
  3. A control deficiency - a change was made to production without authorization documentation, bypassing change management controls regardless of the individual's access level. (correct answer)
  4. Not a finding if the DBA can provide a verbal explanation of the change.
Explanation: Having technical access to make a change does not constitute authorization. Changes to production systems require documented change requests regardless of the individual's role or access level. This is a control deficiency. Answer C is correct. Access rights (A), perceived minor impact (B), and verbal explanations (D) do not substitute for documented change management compliance.

Question 16

Which of the following represents an IT general control weakness related to change management that could directly affect the reliability of financial reporting?

  1. Unauthorized changes to the general ledger application that alter transaction processing logic, producing incorrect financial data. (correct answer)
  2. A delay in upgrading the organization's email system.
  3. Failure to update the IT strategic plan on an annual basis.
  4. An unpatched vulnerability in a non-financial system.
Explanation: Unauthorized changes to financial applications can directly corrupt transaction processing and financial data, affecting the reliability of financial reporting. This is why program change controls are a focus of financial statement audits. Answer A is correct. Email delays (B), strategic plan updates (C), and non-financial system vulnerabilities (D) do not directly affect financial reporting reliability.

Question 17

In IT change management, a 'standard change' differs from a 'normal change' in that:

  1. Standard changes require more extensive testing and CAB approval than normal changes.
  2. Standard changes can only be made by senior IT managers.
  3. Standard changes are pre-approved, low-risk, routine changes with well-established procedures that do not require individual CAB review each time. (correct answer)
  4. Standard changes are limited to hardware replacements and do not include software modifications.
Explanation: Standard changes are pre-approved categories of routine, low-risk changes (e.g., password resets, standard software installs) that follow predefined procedures and do not need individual CAB review for each occurrence. Answer C is correct. Standard changes require less oversight, not more (A). Any authorized staff can execute them (B). They can cover software and hardware (D).

Question 18

Which of the following represents a key detective control in an IT change management framework?

  1. Requiring written approval from the CAB before any change is implemented.
  2. Implementing automated deployment pipelines that enforce change approvals.
  3. Separating developer and production administrator roles.
  4. Comparing actual changes in production to the approved change request log to identify unauthorized modifications. (correct answer)
Explanation: Comparing production changes against the approved change log is a detective control - it identifies changes that occurred without authorization after the fact. Answer D is correct. CAB approval (A), automated pipelines (B), and role separation (C) are all preventive controls.

Question 19

Which of the following testing phases should occur before a change is deployed to the production environment?

  1. User acceptance testing (UAT) should only be performed after the change has been live in production for one week.
  2. Unit testing, integration testing, and user acceptance testing (UAT) should all be completed in non-production environments before production deployment. (correct answer)
  3. Testing is not required for changes that have been approved by the CAB.
  4. Only security testing is required before production deployment; functionality testing can occur post-deployment.
Explanation: Best practice requires progressive testing - unit, integration, and UAT - all completed in test/staging environments before production deployment to minimize the risk of defects or disruptions. Answer B is correct. Post-production testing (A) and no testing for CAB-approved changes (C) are inadequate. Testing all dimensions before deployment (D) is incomplete.

Question 20

When auditing program change controls, which of the following procedures would provide the most direct evidence that unauthorized changes are not being made to production?

  1. Reviewing the IT department's organizational chart to verify segregation of duties.
  2. Interviewing the CIO about the change management policy.
  3. Selecting a sample of production changes and tracing each to a corresponding approved change request and test evidence. (correct answer)
  4. Reviewing the disaster recovery plan for evidence of change management procedures.
Explanation: Tracing production changes to approved change requests and test documentation is the most direct audit procedure for verifying that changes are authorized and tested. Answer C is correct. Org chart review (A) and management interviews (B) provide indirect evidence. Disaster recovery plans (D) address recovery, not change authorization.