CISA Question of the Day: Code Change Authorization Controls

Quiz Yazan Ibrahim

CISA exam practice question — CISA Question of the Day: Code Change Authorization Controls

CISA exam practice question: daily practice for the Certified Information Systems Auditor (CISA) exam — domain: Information Systems Acquisition, Development and Implementation.

Question

During an audit of a new web application deployment, the auditor notes developers occasionally push changes directly to production outside the formal release pipeline. Which of the following artifacts provides the strongest evidence that code changes are authorized, reviewed, and attributable to specific individuals?

  • A. Repository pull request records showing merged branches required two approved code reviews and branch protection rules
  • B. Manager-signed deployment checklists authorizing each change to production
  • C. Defect-tracking entries linking tickets to code files and describing the remediation performed
  • D. Timestamped production backup snapshots captured immediately before and after the change
Show the answer and explanation

Correct answer: A. Repository pull request records showing merged branches required two approved code reviews and branch protection rules

Repository pull request records with enforced branch protection and required approvals provide direct, verifiable evidence that changes were reviewed, authorized, and linked to individual accounts—supporting accountability and integrity of the change process. A manager-signed deployment checklist documents authorization but can be forged or performed after the fact and does not prove technical enforcement or code review. Defect-tracking entries describe issues and related fixes but often lack proof that code reviews occurred or that changes were merged under controlled policies. Backup snapshots show system state but do not demonstrate that changes were reviewed, approved, or attributable to specific reviewers.

Want more practice?

Prepare for the Certified Information Systems Auditor (CISA) exam with IT Department Audit: Risk, IT Control and Governance Evaluation.