CISA: Certified Information Systems Auditor

The most effective control test for change management is an end-to-end walkthrough that traces from the change management documentation (request, approval, authorization) through to the system-generated audit trail reflecting the actual change implemented. This approach validates the entire process chain — confirming that changes were properly requested, reviewed, and approved, and that the system evidence corroborates that only authorized changes were made. Reviewing documentation alone (A) or checking only authorization records (B) or tracing only from system output back to documents (C) each examine only part of the process and could miss gaps such as undocumented changes or approved changes never implemented. A comprehensive end-to-end test provides assurance over completeness, accuracy, and authorization of changes across the full process.