Exam CISA topic 1 question 1142 discussion

D. Trace a sample of program changes from the log to completed PCR forms.

D. Trace a sample of program changes from the log to completed PCR forms.

The only complete data from which to trace is the log.

The best IS audit procedure to determine whether unauthorized changes have been made to production programs is to trace a sample of complete Program Change Request forms to the log of all program changes. This procedure ensures that approved changes documented in PCR forms are correctly reflected in the log of actual program changes.

however, involves using source code comparison software to determine whether any changes have been made to a sample of programs since the last audit date. This approach is more effective because it verifies whether any changes have been made to the actual code itself, rather than just relying on the approval or logging process. If any unauthorized changes are found, the auditor can investigate further to determine how they were made and take appropriate action