Write a $1-2$ page report discussing the role of auditors and the questions they could ask about change and patch management and the importance of creating and maintaining an $$approved$$ list of software from service providers.

Include the steps in the process.

Step $1$: Determine the Purpose and Scope

Step $2$: Choose a Tool or Process

Step $3$: Choose Key Data Points

Step $4$: Conduct the Audit Compile

Step $5$: Analyze Findings