Certified in Risk and Information Systems Control (CRISC) — Question 96

Which of the following is the BEST metric to demonstrate the effectiveness of an organization's change management process?

Answer options

• A. Average time to complete changes
• B. Increase in the number of emergency changes
• C. Percent of unauthorized changes
• D. Increase in the frequency of changes

Correct answer: C

Explanation

The correct answer is C, as a high percentage of unauthorized changes indicates weaknesses in the change management process, highlighting risks and potential security issues. In contrast, option A measures efficiency, option B indicates potential chaos in management, and option D does not directly reflect the quality or control of the change process.