Chapter 17

Change Management

BSA 3-1

Balmes, Christine Nathalie M.

Bonita, Bea Aiziel C.

Villanueva, Rich Ann R.

Villanueva, Jessirie K.

Professor Melinda S. Balbarino

June 02, 2021

 QUESTIONS

TRUE OR FALSE

__________1) Emergency change is triggered when a major incident occurs or when

an important issue is about to happen (like a security upgrade,

regulatory requirement, etc.)

__________2) A record of change requests to be kept for each application and

system.

__________3) Software Release Policy is the process of distributing business

software and applications to all the endpoints within a network.

__________4) Maintenance updates are also considered as a change and should be

accounted for in the change management system.

__________5) Approval by Board of Directors after all the related information is

reviewed.

__________6) Changes can introduce risk to the availability, integrity,

confidentiality, and performance of a system.

__________7) Emergency changes are changes that are required inside of the

prescribed schedule.

__________8) Each change in the organization or IT system requires an impact

assessment to ensure that potential negative consequences of these

changes are identified and planned for.

__________9) Configuration management is controlling the virtual inventory and

relationships among components that form a set of baseline objects

that are subject to change.

__________10) The National Institute of Standards and Technology defined the

process of Software Configuration Management.

__________11) The software configuration management process produces a software

configuration management plan.

__________12) Identifying who is requesting for the change is part of the Change
Management procedures.

__________13) Individuals to be selected in Change Management Board Committees

must be those employees/ officers that the board of directors
personally know.

__________14) If the state of the production environment during the previous week

has been poor, the change board is more likely to approve only those

changes designed to correct problems.

__________15) The major objectives of the Software Configuration Management

process are to track the different versions of the software and ensure

that each version of the software contains the exact software outputs

generated and approved for that version.

 MULTIPLE CHOICE

1. It is defined by the ITIL (Information Technology Infrastructure Library) as a “A change

that must be introduced as soon as possible”, what is it?

A. Emergency Process C. Emergency Change

B. Impact Assessment D. Authorized Maintenance

2. It is defined as a cyber-attack that occurs on the same day as weakness is discovered in

software.

A. Denial of Service Attack C. Trojan Horse

B. Malware D. Zero Day Exploit

3. It will be used when a change needs to be implemented in a compressed timeframe due to

the nature of the change.

A. Revisions to Documentation and Procedures C. Authorized Maintenance

B. Software Release Policy D. Emergency Change Process

4. A change management process is one that consists of the following, except:

A. Analysis C. Risk assessment

B. Implementation D. Review of all changes

5. The proposed change must first be reviewed by _________ to identify potential conflicts

with other systems.

A. Management C. Board of Directors

B. Change management personnel D. Internal Auditors

6. Statement 1: Reducing system disruptions that can lead to business losses.

 Statement 2: Maximizing the number of back outs called by ineffective change

implementation.

Statement 3: Providing accurate and timely documentation to maximize the impact to

change-related problems.

A. All of the statements are correct.

B. All of the statements are incorrect.

C. Two of the statements are correct.

D. One of the statements is correct.

7. ____________ potentially have a greater impact on operations. They frequently affect

many users and typically have lengthy, complex implementation and back out
procedures.

A. Routine Changes C. Emergency Changes

B. Non-routine Changes D. None of the above

8. All of the following are part of the Change Management procedures, except:

A. Document the reason for change. C. Formalize who will make the

change

B. Identify who is requesting the change. D. None of the above

9. Which of the following are included in the scope of change management procedures?

A. System Software C. Application Software

B. Hardware D. All of the above

10. The criteria wherein the change board evaluates the availability of people, time, and

system resources when considering the scheduling and approval of changes.

A. Criticality C. Cumulative effect of all proposed changes

B. Resource Availability D. Change Level

11. It relates to the organization’s ability and methods for adopting, managing, and adapting

to change.

A. Organizational Change Management

B. Change Management Board

C. Change Management Tools and Procedures

D. Change level

12. The following areas are typically covered in a change control audit or examination.

A. Authorization C. Documentation

B. Testing D. All of the above

13. Defined broadly, change management is any process that has an impact on the _______

A. audit environment C. production-processing environment

B. IT environment D. operating environment

14. All are steps in identification of software configuration items, except:

A. Select the most significant and critical function

B. Assign a unique identifier/number to each configuration items

C. Assess problems and changes, implement approved changes, and provide

feedback to processes affected by changes.

D. Establish baselines for the configuration items, that is, documents that have been

formally reviewed and agreed upon

15. Insufficient change control processes have the following risks:

I. System outages due to error, omissions, or malicious intent

II. Authorized changes

III. Fraud/abuse to company systems and/or data

 IV. Communication error

V. Repeated errors

A. II,III,IV C. I,III,V

B. I,II,IV D. I,II,III
ANSWERS

TRUE OR FALSE

1. TRUE

2. TRUE

3. FALSE

4. TRUE

5. FALSE

6. TRUE

7. FALSE

8. TRUE

9. FALSE

10. TRUE

11. TRUE

12. TRUE

13. FALSE

14. TRUE

15. TRUE
MULTIPLE CHOICE

1. C

2. D

3. D

4. C

5. B

6. D

7. B

8. D

9. D

10. B

11. A

12. D

13. C

14. C

15. C