CPA Isc Quiz: Evaluate Change Management Controls

What this quiz covers

This quiz focuses on Evaluate Change Management Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. An unauthorized change to the revenue recognition calculation module in the ERP system. (correct answer)
2. An unauthorized upgrade to the company's email client.
3. A change to the IT help desk ticketing system without proper approvals.
4. An unapproved update to the company's website content management system.

Explanation: Unauthorized changes to financial application logic can directly alter how transactions are processed, producing materially misstated financial reports. Answer A is correct. Email (B), help desk (C), and website (D) systems do not directly process financial transactions.

Question 2

1. The change management policy needs to be simplified.
2. Minor changes present no risk and do not need formal controls.
3. A gap between policy design and operating effectiveness - controls that exist on paper but are not followed do not provide actual protection. (correct answer)
4. The auditor's sample was too small to draw conclusions.

Explanation: When documented controls are not followed in practice, the controls have failed at the operating effectiveness level. Answer C is correct. Policy simplification (A) does not address compliance. Minor changes have caused significant incidents (B). The finding is not a sampling issue if the pattern is consistent (D).

Question 3

1. Whether the CI/CD tool is from a reputable vendor.
2. The number of deployments completed per day.
3. Whether all developers attended CI/CD training.
4. Whether the approval gates are properly configured, enforced, and cannot be bypassed, and whether access to modify the pipeline is appropriately restricted. (correct answer)

Explanation: In automated environments, controls are embedded in the pipeline - the auditor must verify that automation enforces approvals, cannot be bypassed, and is protected from unauthorized modification. Answer D is correct. Vendor reputation (A), deployment volume (B), and training (C) do not address core control questions.

Question 4

1. Some changes were duplicates deployed twice with separate ticket numbers.
2. 30 changes were deployed without approved change requests, indicating unauthorized changes that bypassed the control process. (correct answer)
3. The deployment logs include test environment deployments.
4. The change management system failed to generate tickets for 30 changes due to a software bug.

Explanation: Deployments exceeding approved requests indicates unauthorized changes. Answer B is correct. While other explanations (A, C, D) are possible, unauthorized changes is the primary conclusion subject to further investigation.

Question 5

1. Mandatory code review by a second developer and prohibition on developers deploying their own code to production. (correct answer)
2. Requiring all code to be written in a language approved by the security team.
3. Documenting all code changes in the change management system.
4. Encrypting all source code in the version control repository.

Explanation: Mandatory peer code review catches malicious or erroneous code before deployment; prohibiting self-deployment ensures a second person controls production. Answer A is correct. Language approval (B) and documentation (C) do not detect malicious code. Encryption (D) protects confidentiality, not code integrity.

Question 6

1. Developers may bypass the change management process.
2. Changes may not be properly tested before deployment.
3. The cloud vendor may push automatic updates without the organization's knowledge or approval, changing system behavior unexpectedly. (correct answer)
4. Change documentation may be incomplete.

Explanation: Cloud environments introduce vendor-controlled updates as a unique risk - SaaS providers may update systems automatically, altering functionality without the customer's change management process being applied. Answer C is correct. Developer bypass (A), testing gaps (B), and documentation issues (D) are risks in all environments.

Question 7

1. All IT systems regardless of their connection to financial data.
2. Only systems with a direct internet connection.
3. Physical IT infrastructure such as servers and network equipment.
4. Systems that process, store, or transmit financial data, including the ERP, financial reporting applications, and related interfaces. (correct answer)

Explanation: For financial reporting purposes, change management controls are most critical for in-scope financial systems. Answer D is correct. Not all systems affect financial reporting (A). Internet connection is not the relevant criterion (B). Infrastructure changes are less directly relevant than application changes (C).

Question 8

1. A signed statement from the CIO confirming all changes were properly approved.
2. The existence of a change advisory board meeting schedule.
3. A sample of production changes tested throughout the period, each with documented approval, testing evidence, and deployment by an authorized individual separate from the developer. (correct answer)
4. An absence of IT incidents or outages during the period.

Explanation: Evidence of operating effectiveness comes from testing actual transactions against control requirements throughout the period. Answer C is correct. Management representations (A) and governance structures (B) are indirect evidence. No incidents (D) does not confirm controls operated effectively.

Question 9

1. Four managers must approve every change before deployment.
2. At least two people must be involved in deploying a change - the developer cannot unilaterally push code to production without a second person's involvement. (correct answer)
3. Deployments require review by four different departments.
4. Four separate test environments must be used before production deployment.

Explanation: The four-eyes principle requires at least two people on every production deployment - preventing a single developer from both creating and deploying code. Answer B is correct. It requires two people, not four managers (A) or four departments (C). Testing environments (D) are unrelated.

Question 10

1. Core financial applications, access control systems, and interfaces that feed financial reporting data. (correct answer)
2. User interface cosmetic changes with no backend logic impact.
3. Helpdesk and ticketing systems used only by IT staff.
4. Static marketing content on the company's public website.

Explanation: Changes to financial applications, access controls, and financial data interfaces pose the highest risk to financial reporting integrity. Answer A is correct. Cosmetic UI changes (B), internal IT tools (C), and static marketing content (D) present minimal financial reporting risk.

Question 11

1. The change management system generates a unique ticket number for each request.
2. Developers are required to submit code for peer review before approval.
3. Developers have administrative access to the production deployment tool, allowing them to deploy code without going through the formal approval workflow. (correct answer)
4. The CAB meets weekly to review and approve pending changes.

Explanation: Developer access to deployment tools that allows bypassing the approval workflow renders change management ineffective. Answer C is correct. Ticket generation (A), peer review (B), and CAB meetings (D) are positive control indicators.

Question 12

1. Confirms the change is ready for production deployment.
2. Is an annual review of the change management policy.
3. Is a review of all changes performed by external auditors.
4. Provides evidence that the full change lifecycle was completed and outcomes were evaluated, including whether the change succeeded and any issues were resolved. (correct answer)

Explanation: Post-implementation reviews close the change lifecycle loop and provide evidence of control completeness. Answer D is correct. Pre-deployment review (A) is UAT. Annual policy review (B) is governance. External auditor reviews (C) are audit procedures, not PIRs.

Question 13

1. Reviewing the change management system for the list of all approved changes.
2. Interviewing IT managers about adherence to change management procedures.
3. Comparing all production system modifications in audit trails to the list of approved change requests to identify discrepancies. (correct answer)
4. Confirming the change advisory board met the required number of times during the year.

Explanation: Comparing system-generated logs of actual production changes to the approved change request population directly identifies unauthorized changes. Answer C is correct. The approved list alone (A) does not reveal unauthorized changes. Interviews (B) are subjective. CAB meeting counts (D) address governance, not individual authorization.

Question 14

1. The number of unauthorized changes identified during the audit period.
2. Whether the IT department has acknowledged the deficiency.
3. The age of the change management policy.
4. Whether the deficiency creates a reasonable possibility that a material misstatement could occur and not be prevented or detected by the entity's controls. (correct answer)

Explanation: Severity classification depends on the risk of material financial misstatement going undetected - the key criterion under auditing standards. Answer D is correct. Volume (A) and policy age (C) are factors in analysis. Management acknowledgment (B) does not affect classification.

Question 15

1. User acceptance testing performed before deployment.
2. A post-implementation validation control that confirms changes achieved intended outcomes without adverse effects on business processes. (correct answer)
3. A detective control that identifies system failures after they occur.
4. A compensating control for missing technical testing documentation.

Explanation: Business process owner confirmation after deployment is a post-implementation validation - checking that business operations function correctly following the change, closing the change management cycle. Answer B is correct. Pre-deployment UAT (A) occurs before go-live. This is a validation control, not purely detective (C). It supplements technical testing rather than compensating for missing documentation (D).

Question 16

1. Acceptable - emergency changes are exempt from post-implementation review.
2. A control deficiency - emergency changes require retrospective documentation including post-implementation review to ensure changes worked as intended. (correct answer)
3. A minor finding since the emergency changes appear technically successful.
4. Not a finding - post-implementation reviews are optional for emergency changes.

Explanation: Emergency changes require streamlined upfront authorization followed by mandatory retrospective documentation and post-implementation review. Missing documentation for 80% of emergency changes is a significant finding. Answer B is correct. Emergency changes are not exempt (A, D). Technical success does not substitute for documentation (C).

Question 17

1. Does the organization use agile or waterfall development methodology?
2. Does the change management process require authorization, testing, and segregation of duties before any change reaches production? (correct answer)
3. Does the organization have a dedicated change management software tool?
4. Does the change management process document the names of all developers involved?

Explanation: The most critical design elements are authorization (who approves), testing (quality assurance), and segregation of duties (separation of development and deployment). Answer B is correct. Development methodology (A) and tools (C) are implementation details. Developer names (D) are less important than control structure.

Question 18

1. Selecting a representative sample of production changes throughout the audit period and testing each for evidence of authorization, testing, and proper deployment. (correct answer)
2. Reviewing the change management policy document and confirming it is approved by the CIO.
3. Interviewing the change manager about the change management process.
4. Confirming that the change management system generates a ticket number for each request.

Explanation: Sample-based testing of actual changes throughout the period provides direct evidence of whether controls operated consistently and effectively. Answer A is correct. Policy review (B) and interviews (C) address design. Ticket generation (D) confirms process initiation but not authorization or deployment controls.

Question 19

1. A minor finding since the changes may have been low-risk.
2. An acceptable practice for emergency changes.
3. A significant IT general control deficiency - unauthorized changes to production undermine the integrity of the change management control environment. (correct answer)
4. A documentation issue that does not affect financial reporting reliability.

Explanation: Unauthorized production changes represent a breakdown in IT general controls - without confirmed authorization, the organization cannot ensure changes are appropriate or that malicious modifications have not been introduced. Answer C is correct. Risk level cannot be assumed (A). Emergency changes require retrospective documentation (B). Change management ITGCs directly affect financial reporting (D).

Question 20

1. Review the provider's change management controls through a SOC report or direct testing to obtain assurance that changes made by the provider are authorized and controlled. (correct answer)
2. Confirm the provider is in the same time zone as the company.
3. Verify the provider's employees have passed background checks.
4. Ensure the contract includes a penalty clause for unauthorized changes.

Explanation: When a third party makes changes to production systems, the auditor must obtain assurance over the provider's change management controls. For controls relevant to financial reporting, a SOC 1 report - which covers internal controls over financial reporting - is the appropriate mechanism, or direct testing if a report is unavailable. Answer A is correct. Time zone (B), background checks (C), and contract penalties (D) are not primary control assurance mechanisms.