Exam CISA topic 1 question 1146 discussion

B. Changes and change approvals are not documented. This is because the lack of documentation for changes and approvals can lead to a lack of accountability, traceability, and control. It can also make it difficult to verify that changes have been properly implemented and approved. This could potentially lead to unauthorized changes being made, which could impact the stability and security of the system. Therefore, it is crucial for an organization to document all changes and approvals as part of their configuration and release management process.

Of the options provided, the absence of a centralized configuration management database (CMDB) should be of GREATEST concern to an IS auditor assessing an organization's configuration and release management process. A centralized CMDB is a critical component of effective configuration and release management. It serves as a centralized repository for storing and managing information about configuration items (CIs), including hardware, software, and their relationships. Without a CMDB, it becomes challenging to track and manage changes, dependencies, and configurations in a systematic and controlled manner.

B. Changes and change approvals are not documented.

I think its C - No CMDB is a problematic