Exam CISA topic 1 question 202 discussion

Since these quarterly price update jobs are not going through the regular change management process, continuous monitoring is crucial to detect any unexpected or erroneous changes resulting from the scheduled job. Exception reports will highlight anomalies or irregularities in the updated prices, enabling timely investigation and correction. This control provides a safety net that compensates for the lack of formal change management for these automated updates. Why not the others? A. An overarching approval from the change advisory board This would be ideal, but the question states the updates are outside the regular change management process. B. User acceptance testing (UAT) after production run UAT is generally performed before production deployment, and after-the-fact UAT is inefficient and may not catch issues timely. C. Each production run is approved by an authorized individual Approving a scheduled automated run may not be practical or effective without checking results post-run.

This ensures accountability and oversight, mitigating the risk of unauthorized or incorrect updates that could adversely affect the system or its data.

Approval control that does not go through the normal change　management process should be responsibility of the CAB.

Based on best practices and ISACA standards, the MOST important control to have in place in this scenario would be: A. An overarching approval is obtained from the change advisory board. Implementing an overarching approval process from the change advisory board ensures that changes, even if they are scheduled and recurring, are reviewed and approved by appropriate stakeholders. This helps maintain accountability, oversight, and alignment with organizational policies and objectives. While other controls such as user acceptance testing (option B), individual approvals (option C), and exception reporting (option D) are valuable, obtaining approval from the change advisory board ensures a comprehensive review and oversight of the changes, mitigating risks associated with unmanaged modifications to critical database tables.

Implies 4 eyes principle

C. Each production run is approved by an authorized individual.