CPA Quiz: Evaluate Change Management Controls
20 questions · exam conditions
0:00
Evaluate Change Management ControlsQuestion 1 of 20

An organization has strong documented change management policies but the auditor's testing reveals that employees routinely bypass the process for 'minor' changes. This situation most likely indicates:

The change management policy needs to be simplified.
Minor changes present no risk and do not need formal controls.
A gap between policy design and operating effectiveness - controls that exist on paper but are not followed do not provide actual protection.
The auditor's sample was too small to draw conclusions.
← Back to quizzes

CPA Quiz

CPA Quiz: Evaluate Change Management Controls

Practice Evaluate Change Management Controls in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Evaluate Change Management Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An organization has strong documented change management policies but the auditor's testing reveals that employees routinely bypass the process for 'minor' changes. This situation most likely indicates:

  1. The change management policy needs to be simplified.
  2. Minor changes present no risk and do not need formal controls.
  3. A gap between policy design and operating effectiveness - controls that exist on paper but are not followed do not provide actual protection. (correct answer)
  4. The auditor's sample was too small to draw conclusions.
Explanation: When documented controls are not followed in practice, the controls have failed at the operating effectiveness level. Answer C is correct. Policy simplification (A) does not address compliance. Minor changes have caused significant incidents (B). The finding is not a sampling issue if the pattern is consistent (D).

Question 2

A company implements a 'four-eyes' principle for production deployments. This means:

  1. Four managers must approve every change before deployment.
  2. At least two people must be involved in deploying a change - the developer cannot unilaterally push code to production without a second person's involvement. (correct answer)
  3. Deployments require review by four different departments.
  4. Four separate test environments must be used before production deployment.
Explanation: The four-eyes principle requires at least two people on every production deployment - preventing a single developer from both creating and deploying code. Answer B is correct. It requires two people, not four managers (A) or four departments (C). Testing environments (D) are unrelated.

Question 3

When determining whether a change management control deficiency should be reported as a significant deficiency or material weakness for financial reporting purposes, the most important factor is:

  1. The number of unauthorized changes identified during the audit period.
  2. Whether the IT department has acknowledged the deficiency.
  3. The age of the change management policy.
  4. Whether the deficiency creates a reasonable possibility that a material misstatement could occur and not be prevented or detected by the entity's controls. (correct answer)
Explanation: Severity classification depends on the risk of material financial misstatement going undetected - the key criterion under auditing standards. Answer D is correct. Volume (A) and policy age (C) are factors in analysis. Management acknowledgment (B) does not affect classification.

Question 4

Which of the following most effectively evaluates the operating effectiveness of change management controls over a period?

  1. Selecting a representative sample of production changes throughout the audit period and testing each for evidence of authorization, testing, and proper deployment. (correct answer)
  2. Reviewing the change management policy document and confirming it is approved by the CIO.
  3. Interviewing the change manager about the change management process.
  4. Confirming that the change management system generates a ticket number for each request.
Explanation: Sample-based testing of actual changes throughout the period provides direct evidence of whether controls operated consistently and effectively. Answer A is correct. Policy review (B) and interviews (C) address design. Ticket generation (D) confirms process initiation but not authorization or deployment controls.

Question 5

An auditor evaluating change management at a company using an outsourced IT provider should most importantly:

  1. Review the provider's change management controls through a SOC report or direct testing to obtain assurance that changes made by the provider are authorized and controlled. (correct answer)
  2. Confirm the provider is in the same time zone as the company.
  3. Verify the provider's employees have passed background checks.
  4. Ensure the contract includes a penalty clause for unauthorized changes.
Explanation: When a third party makes changes to production systems, the auditor must obtain assurance over the provider's change management controls. For controls relevant to financial reporting, a SOC 1 report - which covers internal controls over financial reporting - is the appropriate mechanism, or direct testing if a report is unavailable. Answer A is correct. Time zone (B), background checks (C), and contract penalties (D) are not primary control assurance mechanisms.

Question 6

An auditor tests change management controls and finds that one sampled change was deployed without testing documentation. The developer explains the change was 'only a one-line code fix.' The auditor should:

  1. Accept the explanation and remove the exception from the sample.
  2. Reduce the severity since the change was minor.
  3. Accept the explanation but note it as a minor deviation.
  4. Record the exception regardless - all changes require testing documentation per policy, and exceptions indicate the control did not operate as designed. (correct answer)
Explanation: Control exceptions must be recorded regardless of perceived complexity. A 'minor' change without testing is still a policy violation. Answer D is correct. Accepting explanations without evidence (A, B, C) undermines the audit.

Question 7

An auditor is evaluating IT change management controls and selects a sample of changes deployed to production during the year. For each sampled change, the auditor should verify which of the following?

  1. That the change was written by a developer with at least five years of experience.
  2. That each change has an approved change request, evidence of testing, and was deployed by an individual other than the developer who wrote the code. (correct answer)
  3. That the change was completed within the originally estimated timeframe.
  4. That the change was discussed at the monthly IT steering committee meeting.
Explanation: The three key elements of change management control evidence are: authorization (approved change request), quality assurance (testing documentation), and segregation of duties (deployment by someone other than the developer). Answer B is correct. Developer experience (A) and timeline adherence (C) are management concerns. Steering committee discussion (D) is governance but not required for individual changes.

Question 8

Which of the following change management scenarios most directly threatens the reliability of financial reporting?

  1. An unauthorized change to the revenue recognition calculation module in the ERP system. (correct answer)
  2. An unauthorized upgrade to the company's email client.
  3. A change to the IT help desk ticketing system without proper approvals.
  4. An unapproved update to the company's website content management system.
Explanation: Unauthorized changes to financial application logic can directly alter how transactions are processed, producing materially misstated financial reports. Answer A is correct. Email (B), help desk (C), and website (D) systems do not directly process financial transactions.

Question 9

A company uses automated CI/CD pipelines with built-in approval gates. An auditor evaluating change management controls should primarily focus on:

  1. Whether the CI/CD tool is from a reputable vendor.
  2. The number of deployments completed per day.
  3. Whether all developers attended CI/CD training.
  4. Whether the approval gates are properly configured, enforced, and cannot be bypassed, and whether access to modify the pipeline is appropriately restricted. (correct answer)
Explanation: In automated environments, controls are embedded in the pipeline - the auditor must verify that automation enforces approvals, cannot be bypassed, and is protected from unauthorized modification. Answer D is correct. Vendor reputation (A), deployment volume (B), and training (C) do not address core control questions.

Question 10

An auditor finds that a change management system shows 200 approved change requests, but deployment logs reveal 230 deployments. The most likely explanation and risk is:

  1. Some changes were duplicates deployed twice with separate ticket numbers.
  2. 30 changes were deployed without approved change requests, indicating unauthorized changes that bypassed the control process. (correct answer)
  3. The deployment logs include test environment deployments.
  4. The change management system failed to generate tickets for 30 changes due to a software bug.
Explanation: Deployments exceeding approved requests indicates unauthorized changes. Answer B is correct. While other explanations (A, C, D) are possible, unauthorized changes is the primary conclusion subject to further investigation.

Question 11

Which change management control most directly addresses the risk that a developer introduces malicious code into a production system?

  1. Mandatory code review by a second developer and prohibition on developers deploying their own code to production. (correct answer)
  2. Requiring all code to be written in a language approved by the security team.
  3. Documenting all code changes in the change management system.
  4. Encrypting all source code in the version control repository.
Explanation: Mandatory peer code review catches malicious or erroneous code before deployment; prohibiting self-deployment ensures a second person controls production. Answer A is correct. Language approval (B) and documentation (C) do not detect malicious code. Encryption (D) protects confidentiality, not code integrity.

Question 12

An auditor evaluating change management controls for a company that recently migrated to a cloud-based ERP system should consider which risk most unique to cloud environments?

  1. Developers may bypass the change management process.
  2. Changes may not be properly tested before deployment.
  3. The cloud vendor may push automatic updates without the organization's knowledge or approval, changing system behavior unexpectedly. (correct answer)
  4. Change documentation may be incomplete.
Explanation: Cloud environments introduce vendor-controlled updates as a unique risk - SaaS providers may update systems automatically, altering functionality without the customer's change management process being applied. Answer C is correct. Developer bypass (A), testing gaps (B), and documentation issues (D) are risks in all environments.

Question 13

When evaluating whether change management controls adequately protect financial reporting, an auditor should focus primarily on changes to:

  1. All IT systems regardless of their connection to financial data.
  2. Only systems with a direct internet connection.
  3. Physical IT infrastructure such as servers and network equipment.
  4. Systems that process, store, or transmit financial data, including the ERP, financial reporting applications, and related interfaces. (correct answer)
Explanation: For financial reporting purposes, change management controls are most critical for in-scope financial systems. Answer D is correct. Not all systems affect financial reporting (A). Internet connection is not the relevant criterion (B). Infrastructure changes are less directly relevant than application changes (C).

Question 14

Which of the following represents the strongest evidence that an organization's change management controls operated effectively throughout the audit period?

  1. A signed statement from the CIO confirming all changes were properly approved.
  2. The existence of a change advisory board meeting schedule.
  3. A sample of production changes tested throughout the period, each with documented approval, testing evidence, and deployment by an authorized individual separate from the developer. (correct answer)
  4. An absence of IT incidents or outages during the period.
Explanation: Evidence of operating effectiveness comes from testing actual transactions against control requirements throughout the period. Answer C is correct. Management representations (A) and governance structures (B) are indirect evidence. No incidents (D) does not confirm controls operated effectively.

Question 15

When performing a risk-based assessment of change management controls, an auditor should assign highest risk to changes affecting:

  1. Core financial applications, access control systems, and interfaces that feed financial reporting data. (correct answer)
  2. User interface cosmetic changes with no backend logic impact.
  3. Helpdesk and ticketing systems used only by IT staff.
  4. Static marketing content on the company's public website.
Explanation: Changes to financial applications, access controls, and financial data interfaces pose the highest risk to financial reporting integrity. Answer A is correct. Cosmetic UI changes (B), internal IT tools (C), and static marketing content (D) present minimal financial reporting risk.

Question 16

An auditor evaluating whether IT change management controls mitigate unauthorized program change risk would identify which finding as indicating controls are NOT effective?

  1. The change management system generates a unique ticket number for each request.
  2. Developers are required to submit code for peer review before approval.
  3. Developers have administrative access to the production deployment tool, allowing them to deploy code without going through the formal approval workflow. (correct answer)
  4. The CAB meets weekly to review and approve pending changes.
Explanation: Developer access to deployment tools that allows bypassing the approval workflow renders change management ineffective. Answer C is correct. Ticket generation (A), peer review (B), and CAB meetings (D) are positive control indicators.

Question 17

A 'post-implementation review' in change management is most relevant to an auditor because it:

  1. Confirms the change is ready for production deployment.
  2. Is an annual review of the change management policy.
  3. Is a review of all changes performed by external auditors.
  4. Provides evidence that the full change lifecycle was completed and outcomes were evaluated, including whether the change succeeded and any issues were resolved. (correct answer)
Explanation: Post-implementation reviews close the change lifecycle loop and provide evidence of control completeness. Answer D is correct. Pre-deployment review (A) is UAT. Annual policy review (B) is governance. External auditor reviews (C) are audit procedures, not PIRs.

Question 18

Which audit procedure would most directly detect whether any changes were made to the production environment outside the formal change management process?

  1. Reviewing the change management system for the list of all approved changes.
  2. Interviewing IT managers about adherence to change management procedures.
  3. Comparing all production system modifications in audit trails to the list of approved change requests to identify discrepancies. (correct answer)
  4. Confirming the change advisory board met the required number of times during the year.
Explanation: Comparing system-generated logs of actual production changes to the approved change request population directly identifies unauthorized changes. Answer C is correct. The approved list alone (A) does not reveal unauthorized changes. Interviews (B) are subjective. CAB meeting counts (D) address governance, not individual authorization.

Question 19

An organization's change management process requires that after each significant change, the business process owners confirm the system is operating as expected. This activity is best described as:

  1. User acceptance testing performed before deployment.
  2. A post-implementation validation control that confirms changes achieved intended outcomes without adverse effects on business processes. (correct answer)
  3. A detective control that identifies system failures after they occur.
  4. A compensating control for missing technical testing documentation.
Explanation: Business process owner confirmation after deployment is a post-implementation validation - checking that business operations function correctly following the change, closing the change management cycle. Answer B is correct. Pre-deployment UAT (A) occurs before go-live. This is a validation control, not purely detective (C). It supplements technical testing rather than compensating for missing documentation (D).

Question 20

When evaluating the design of change management controls, which of the following questions is most important?

  1. Does the organization use agile or waterfall development methodology?
  2. Does the change management process require authorization, testing, and segregation of duties before any change reaches production? (correct answer)
  3. Does the organization have a dedicated change management software tool?
  4. Does the change management process document the names of all developers involved?
Explanation: The most critical design elements are authorization (who approves), testing (quality assurance), and segregation of duties (separation of development and deployment). Answer B is correct. Development methodology (A) and tools (C) are implementation details. Developer names (D) are less important than control structure.