Exam CISA topic 1 question 619 discussion

first is ensuring only authorized changes are taking place. then SOD's can be checked for compensating controls

When database administrators (DBAs) are responsible for developing and implementing changes to a production environment, it is important that those changes are properly managed. A change management process is a framework for consistently managing the planning, approval, implementation, monitoring, and evaluation of change.

B. Identify whether any compensating controls exist.

Identifying and reporting a segregation of duties (SoD) violation is crucial because it highlights the potential risk associated with a single individual having both development and execution responsibilities in the production environment. This situation poses a risk of unauthorized or erroneous changes, and reporting the SoD violation can trigger corrective actions to mitigate this risk. Addressing the segregation of duties issue is a fundamental concern that needs immediate attention to enhance control and security. The auditor can then work collaboratively with the organization to implement appropriate measures, such as a change management process or additional controls, to mitigate the identified risk.

B is answer.

I'll go with D; the first order of business should be to report the SoD violation as its a direct risk