CGEIT: Certified in the Governance of Enterprise ITDemo

Question

Which of the following is the BEST method for addressing an IT audit finding that appropriate documentation is missing for many enterprise application updates?

A Add change control to the risk register.
B Conduct software quality audits.
C Enforce change control procedures.
D Review the application development life cycle.

Explanation

Enforced change control procedures require application updates to be formally reviewed, approved, recorded, and documented. This directly corrects the control weakness causing undocumented updates, while a risk-register entry, quality audit, or general SDLC review does not itself ensure that each change is documented.

Learn more

NIST SP 800-171 Rev. 3 — Configuration Change Control

CGEIT: Certified in the Governance of Enterprise ITDemo

AstroTutor

Notes

Readiness

QuestionQ197

Community Discussion