Which of the following would provide the BEST evidence that a cloud provider's change management process is effective?

The correct answer is C. The results of a third-party review provided by the vendor. A third-party review (such as a SOC 2 report or ISO 27001 audit) provides independent, objective evidence that the vendor's change management process actually operates effectively-not just that it exists on paper. Meeting minutes (A) only confirm discussions occurred, not…

Submitted by obi.ng· Apr 18, 2026Information System Auditing Process

Question

Options

AMinutes from regular change management meetings with the vendor
BWritten assurances from the vendor's CEO and CIO
CThe results of a third-party review provided by the vendor
DA copy of change management policies provided by the vendor

How the community answered

(44 responses)

A
5% (2)
B
14% (6)
C
75% (33)
D
7% (3)

Explanation

A third-party review (such as a SOC 2 report or ISO 27001 audit) provides independent, objective evidence that the vendor's change management process actually operates effectively-not just that it exists on paper. Meeting minutes (A) only confirm discussions occurred, not outcomes. Written assurances from executives (B) are subjective and carry no verification. A copy of policies (D) demonstrates that documented procedures exist but says nothing about whether those procedures are followed or effective. Independent audit results are the gold standard of control evidence because they are produced by a party with no interest in the outcome.

Topics

#Audit Evidence#Third-Party Assurance#Change Management#Vendor Management

Community Discussion

No community discussion yet for this question.

Full CISA Practice