Certified Information Systems Auditor (CISA) — Question 1003

Which of the following indicates an effective change control environment?

Answer options

• A. There is version control for the program documentation.
• B. User management formally approves change requests.
• C. Release management is automated.
• D. The quality assurance (QA) group reports to the application development manager.

Correct answer: B

Explanation

The correct answer, B, highlights the importance of formal approval from user management in change control, ensuring accountability and oversight. Options A, C, and D, while beneficial to the process, do not directly indicate the effectiveness of the change control environment in terms of approval and governance.