CISA: Certified Information Systems Auditor

Vendor-supplied changes must be subject to the same change-management controls as internally developed changes, including assessment, authorization, testing, implementation control, and documentation. Omitting them from the process leaves potentially significant changes unmanaged and unreviewed.