The quality assurance (QA) department is short-staffed and is unable to test all modules before the anticipated release date of an application. What security control is MOST likely to be violated?

Separation of environments refers to keeping development, testing, and production environments distinct, which is not directly violated by the QA staffing shortage or incomplete testing.

Program management relates to the overall governance and oversight of IT programs and projects, not the specific control around testing and approving changes before deployment.

Mobile code controls refer to security policies governing the use of executable content such as Java applets or scripts that can be transferred across networks, which is unrelated to the QA testing scenario.

Change management requires that all changes to systems, including application releases, go through a formal process that includes testing, review, and approval before deployment to production. Releasing an application with untested modules bypasses the verification and validation gates inherent in change management, introducing uncontrolled risk into the production environment. This directly violates the principle that changes must be fully assessed and authorized prior to implementation.