Isaca CISA Exam - Topic 2 Question 94 Discussion

Actual exam question for Isaca's CISA exam

Question #: 94
Topic #: 2

[All CISA Questions]

Which of the following would provide the BEST evidence that a cloud provider's change management process is effective?

AMinutes from regular change management meetings with the vendor

BWritten assurances from the vendor's CEO and CIO

CThe results of a third-party review provided by the vendor

DA copy of change management policies provided by the vendor

Show Suggested Answer

Suggested Answer: C

The results of a third-party review provided by the vendor would provide the best evidence that a cloud provider's change management process is effective, because it would be an independent and objective assessment of the vendor's compliance with best practices and standards for managing changes in the cloud environment. A third-party review would also include testing of the vendor's change management controls and procedures, and provide recommendations for improvement if needed.

Minutes from regular change management meetings with the vendor would not provide sufficient evidence, because they would only reflect the vendor's self-reported information and may not capture all the changes that occurred or their impact on the cloud services. Written assurances from the vendor's CEO and CIO would also not provide sufficient evidence, because they would be based on the vendor's own opinion and may not be verified by external sources. A copy of change management policies provided by the vendor would not provide sufficient evidence, because it would only show the vendor's intended approach to change management, but not how it is implemented or monitored in practice.

ISACA Cloud Computing Audit Program, Section 4.5: Change Management

Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives, Section 4.3: Change Management

by Maynard at Jan 15, 2025, 12:15 AM

Limited Time Offer

25%

Off

Get Premium CISA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Linn

3 months ago

Policies are good, but they need to be enforced!

upvoted 0 times

...

Lashaunda

3 months ago

Wait, can we really trust the vendor's own review?

upvoted 0 times

...

Linwood

3 months ago

Written assurances? Sounds like fluff to me.

upvoted 0 times

...

Joanna

4 months ago

I think third-party reviews are more reliable.

upvoted 0 times

...

Dianne

4 months ago

Minutes from meetings show actual discussions happening.

upvoted 0 times

...

Brandon

4 months ago

I lean towards option D because having documented policies is important, but I wonder if they really prove effectiveness without seeing them in action.

upvoted 0 times

...

Ezekiel

4 months ago

I feel like minutes from meetings (option A) could show ongoing discussions, but they might not reflect actual effectiveness.

upvoted 0 times

...

Lavera

4 months ago

I'm not so sure about that. I remember a practice question where internal documents were considered less reliable than external audits.

upvoted 0 times

...

Chantell

5 months ago

I think option C might be the best choice since a third-party review would provide an unbiased perspective on the change management process.

upvoted 0 times

...

Afton

5 months ago

I'm leaning towards the third-party review as well. That seems like the most objective and thorough way to assess the effectiveness of their change management process. The other options feel a bit too subjective or limited in scope.

upvoted 0 times

...

Irving

5 months ago

I think the key here is to look for independent verification of the cloud provider's change management practices, rather than just taking their word for it. The third-party review seems like the most reliable option to me.

upvoted 0 times

...

Misty

5 months ago

Hmm, I'm a bit unsure about this one. I'm trying to think through what kind of evidence would best demonstrate the effectiveness of their change management process. The third-party review might be a good option, but I'm not totally sure.

upvoted 0 times

...

Wendell

5 months ago

This seems like a pretty straightforward question. I'd focus on looking for objective evidence of the cloud provider's change management process, rather than just relying on their assurances.

upvoted 0 times

...

Lynelle

1 year ago

I think C) The results of a third-party review provided by the vendor could also be strong evidence of effective change management.

upvoted 0 times

...

Magda

1 year ago

I agree with Whitley. Having documented minutes from meetings shows ongoing communication and oversight.

upvoted 0 times

...

Whitley

1 year ago

I think A) Minutes from regular change management meetings with the vendor would be the best evidence.

upvoted 0 times

...

Jolanda

1 year ago

The third-party review is the clear winner here. Unless the vendor's CEO and CIO are also world-class magicians, in which case I might consider their written assurances.

upvoted 0 times

...

Joaquin

1 year ago

A copy of the change management policies? Might as well ask the vendor to recite the policies while juggling chainsaws. The third-party review is the way to go, folks.

upvoted 0 times

Madalyn

1 year ago

I agree, a third-party review is more reliable than just trusting what the vendor says.

upvoted 0 times

...

Jade

1 year ago

Vendor's CEO and CIO could just be giving lip service, we need independent verification.

upvoted 0 times

...

Javier

1 year ago

Vendor's CEO and CIO assurances? More like hot air and empty promises. I'll take the third-party review any day!

upvoted 0 times

Janella

1 year ago

A copy of the change management policies could also give insight into how the process is structured.

upvoted 0 times

...

Harley

1 year ago

I think minutes from change management meetings would also be helpful to see the process in action.

upvoted 0 times

...

Carmen

1 year ago

I agree, third-party reviews are more reliable than promises from the CEO and CIO.

upvoted 0 times

...

Willow

1 year ago

The change management meeting minutes could be a good indicator, but I'm not sure they'd provide the full picture. The third-party review seems like the safest bet.

upvoted 0 times

...

Darell

1 year ago

I think the third-party review would give the best evidence of the change management process. The vendor's own policies and assurances might not be as objective.

upvoted 0 times