An IS auditor evaluating the change management process must select a sample from the change log. What is the BEST way for the auditor to confirm the change log is complete?

The correct answer is B. Take the last change from the system and trace it back to the log.. To confirm completeness of a change log, the auditor must work from the authoritative source (the system itself) back to the log - not the other way around. Taking a change from the system and tracing it to the log tests whether all system changes were recorded. If you start from

Submitted by manish99· Apr 18, 2026Information Systems Auditing Process

Question

Options

AObtain management attestation of completeness.
BTake the last change from the system and trace it back to the log.
CTake an item from the log and trace it back to the system.
DInterview change management personnel about completeness.

How the community answered

(37 responses)

A
8% (3)
B
73% (27)
C
16% (6)
D
3% (1)

Explanation

To confirm completeness of a change log, the auditor must work from the authoritative source (the system itself) back to the log - not the other way around. Taking a change from the system and tracing it to the log tests whether all system changes were recorded. If you start from the log and trace to the system (C), you are testing validity/accuracy, not completeness - items in the log did happen, but items that happened may not be in the log. Management attestation (A) and interviews (D) are not objective evidence and provide low assurance over completeness.

Topics

#IS audit procedures#Completeness testing#Change management audit#Audit sampling

Community Discussion

No community discussion yet for this question.

Full CISA Practice