ITPEC FE Morning April 2022 Question 59
Which of the following is an appropriate description of a checkpoint during the audit of a control for reducing the risk of system trouble regarding the application of a software patch?
Explanation
Checking the system's operation status before starting full-time operations — the control that stops a faulty patch from causing trouble in production.
A patch changes software that is already in service, so the risk is that it breaks something. The control is to confirm that the patched system works properly, in a test environment and a trial run, before it goes into full operation. The auditor checks that this confirmation is required and is actually carried out.
Answer (d)
Why not others:
- •(a) — appointing a database administrator and setting master data procedures controls data management, not software changes
- •(b) — capacity planning procedures control the risk of resources running short as the load grows
- •(c) — hardware maintenance records control the upkeep of the hardware, not changes to software
Key rule: Match each audit checkpoint to the risk it names; for a change such as a patch, the control is verifying the result before it reaches production.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.