IIA-CIA-Part3 Exam Dumps : Business Knowledge for Internal Auditing

Effective change management ensures that IT changes (such as software updates, system modifications, or infrastructure upgrades) are well-controlled, minimizing disruptions. Poor change management leads to instability, inefficiencies, and operational risks.

Unplanned Downtime (2) – Indicates that changes are being implemented without proper testing or failover planning, disrupting business operations.

Excessive Troubleshooting (3) – Suggests that changes are causing recurring issues, leading to increased workload for IT support teams.

Unavailability of Critical Services (4) – Highlights that change-related failures are affecting essential business functions, indicating improper risk assessment.

While inadequate control design is a general IT risk, it is not a direct indicator of poor change management. Instead, it relates more to weaknesses in IT governance and security frameworks.

IIA’s GTAG (Global Technology Audit Guide) on Change Management – Identifies unplanned downtime, excessive troubleshooting, and service unavailability as key red flags of poor change management.

COBIT 2019 (Governance and Management of IT) – Emphasizes structured change management to minimize disruptions.

ITIL Change Management Framework – Highlights these issues as symptoms of ineffective change control.

Why 2, 3, and 4 Are Indicators of Poor Change Management?Why Not Option 1 (Inadequate Control Design)?IIA References:✅ Final Answer: D. 2, 3, and 4 only.

Understanding Information Security Responsibilities:

Executive management sets the overall strategy and ensures resources are allocated for information security.

Internal auditors provide independent assurance on security effectiveness.

The board provides oversight and ensures that security risks are managed appropriately.

Line management is responsible for day-to-day operations, including the review and monitoring of security controls to ensure compliance with security policies.

Why Reviewing and Monitoring Security Controls is a Line Management Function:

Line management directly oversees operational security measures, ensuring that established controls are functioning effectively.

They address security gaps, enforce security policies, and report issues to senior management when necessary.

This aligns with IIA Standard 2120 – Risk Management, which requires management to implement and monitor risk mitigation controls.

Why Other Options Are Incorrect:

B. Dedicate sufficient security resources: This is the responsibility of executive management, as they control resource allocation.

C. Provide oversight to the security function: The board and executive management provide oversight, not line management.

D. Assess information control environments: Internal auditors assess control environments, ensuring compliance and effectiveness.

IIA Standards and References:

IIA Standard 2110 – Governance: Emphasizes the board’s role in overseeing security.

IIA Standard 2120 – Risk Management: States that management must monitor security risks.

IIA GTAG (Global Technology Audit Guide) on Information Security (2016): Outlines that line management is responsible for monitoring security controls on a daily basis.

Thus, the correct answer is A: Review and monitor security controls.