CRISC · Question #117
Of the following, who is responsible for approval when a change in an application system is ready for release to production?
The correct answer is C. Business owner. The business owner is responsible for approving changes to an application system before release to production, as they represent the primary stakeholders whose operations and objectives are directly affected.
Question
Of the following, who is responsible for approval when a change in an application system is ready for release to production?
Options
- AInformation security officer
- BIT risk manager
- CBusiness owner
- DChief risk officer (CRO)
How the community answered
(41 responses)- B5% (2)
- C93% (38)
- D2% (1)
Why each option
The business owner is responsible for approving changes to an application system before release to production, as they represent the primary stakeholders whose operations and objectives are directly affected.
The Information Security Officer's role is to ensure the change meets security requirements, not typically to give the final business approval for a production release.
An IT risk manager assesses the risks associated with the change but does not typically have the authority for final business approval of a production release.
The business owner is the ultimate stakeholder of the application system, responsible for its alignment with business objectives and operations, and therefore has the authority and accountability for approving changes that impact their business processes.
The Chief Risk Officer (CRO) has an enterprise-wide risk management role and would not typically approve individual application system changes for production release.
Concept tested: Change management approval roles
Source: https://www.isaca.org/resources/isaca-journal/issues/2006/volume-4/a-new-look-at-change-management
Topics
Community Discussion
No community discussion yet for this question.