Answer should be B. Change control process Every chance/update including infrastructure update should / must follow the established change management process.

agreed the answer is B - the best control is Preventive, audit is a detective control, hence B is a better option

It is B.

i like D but its B. a significant update in Infra Stru. warrants a risk assessment as the risk profile might change, irrespective of existence of a Change Control Process

Agree 'B'.

A change management audit is an independent appraisal that provides feedback to management regarding the design and operational effectiveness of the change management controls in place and helps to identify if any control design or operational weaknesses exist. Change Control is the process that management uses to identify, document, and authorize changes to an IT environment. It minimizes the likelihood of disruptions, unauthorized alterations and errors. The change control procedures should be designed with the size and complexity of the environment in mind.

The answer is total garbage. I mean, most of the answers given have no justification. How can an audit mitigate any risk associated with infrastructure update?. In order to do any update or change, a Change Control process is put in place, and approval has to be made.

B: Change control process

agree with B