Home / CPA Course / ISC

Change management

ISC Chapter 4 · Area I · Blueprint I.A.4

Most system failures start with a change: a new release, a patch, a setting someone flipped on a Friday afternoon. In this chapter a website release at Brightwater charges the wrong sales tax for a weekend, and Priya and Sam trace how it slipped through. You will learn why change management exists, the tools and documents it uses, the environments and tests a change passes through, how to convert to a new system, how patches are managed, and how an auditor tests change controls, including in fast-moving CI/CD pipelines and over configuration settings. The skills here carry straight into SOC 2 testing in chapters 14 and 19.

In this chapter

1. Why changes need managing
2. The tools and documents of change
3. Environments and testing
4. Converting to a new system
5. Patch management
6. Testing change controls, including CI/CD
7. Configuration parameters: settings are changes too

This chapter has 7 lessons, 50 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

• Change risks
• tools and documentation
• development, staging and production
• test types
• conversion methods
• patch management
• change control testing

Chapter 3: Availability · Chapter 5: Data storage and the data life cycle