nerdexam
Isaca

CISA · Question #106

A company requires that all program change requests (PCRs) be approved and all modifications be automatically logged. Which of the following is audit procedures will BEST determine whether…

The correct answer is D. Trace a sample of program changes from the log to completed PCR forms. To best determine if unauthorized changes were made, an audit should trace program changes recorded in the log back to approved PCR forms, verifying that every change has proper authorization.

Submitted by suresh_in· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

A company requires that all program change requests (PCRs) be approved and all modifications be automatically logged. Which of the following is audit procedures will BEST determine whether unauthorized changes have been made to production programs?

Options

  • AUse source code comparison software to determine whether any changes have been made to a
  • BReview a sample of PCRs for proper approval throughout the program change process.
  • CTrace a sample of complete PCR forms to the log of all program changes.
  • DTrace a sample of program changes from the log to completed PCR forms.

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    15% (5)
  • C
    12% (4)
  • D
    71% (24)

Why each option

To best determine if unauthorized changes were made, an audit should trace program changes recorded in the log back to approved PCR forms, verifying that every change has proper authorization.

AUse source code comparison software to determine whether any changes have been made to a

Source code comparison software identifies *what* changes were made, but doesn't inherently verify *authorization* for those changes.

BReview a sample of PCRs for proper approval throughout the program change process.

Reviewing PCRs for approval checks the *process for requested changes*, but doesn't confirm if *all actual changes* originated from approved PCRs.

CTrace a sample of complete PCR forms to the log of all program changes.

Tracing PCRs to the log confirms that approved changes were logged, but it doesn't reveal whether *unapproved changes* were also made and logged or made without a PCR.

DTrace a sample of program changes from the log to completed PCR forms.Correct

Tracing changes from the log of *all* program modifications to *completed PCR forms* ensures that every modification that occurred in the production environment has a corresponding, approved request. This audit procedure directly identifies any changes in the log that lack proper authorization, thus detecting unauthorized changes.

Concept tested: IT change management audit

Topics

#Program change management#Audit procedures#Unauthorized changes#Change control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISA Practice