Change management controls are a type of IT organization and management controls, which are a subset of IT management-level (general) controls.
a. What are change management controls?
b. Assume that an organization’s change management controls pertaining to application software are ineffective. What impact would this have on the reliance that management can place on application-based controls?
c. Assume instead that the organization’s change management controls pertaining to application software are effective. Assume further that the internal audit function determined that the controls imbedded in the purchasing process application software were designed adequately and operating effectively last year. What impact would this have on this year’s internal audit testing of the controls imbedded in the purchasing process application software?
d. Based on the answers to 4. b. and 4. c. above, what general conclusion can be reached about the relationship between IT management-level (general) controls and application-based controls?