How should internal audit evaluate production data changes?

author: AcadiFi Team

• Related article: cia-production-change-policy-exception-controls-map
• Related question-bank placeholders: ["production-change-without-backup", "change-control-audit-test"]
• Question: How should internal audit evaluate production data changes?
• Question detail:
• If a team manually changes live data to fix an urgent issue, what should internal audit expect to see?
• Answer:
• Internal audit should expect evidence that the change was requested, risk-assessed, approved, tested where feasible, implemented by an authorized person, logged, validated, and closed. The exact rigor depends on the risk, but live data changes should not be treated as casual operational shortcuts.
• Useful evidence includes a change ticket, affected population, approval by the data or system owner, test results, backup or rollback evidence, implementation logs, before-and-after counts, exception handling, and post-change validation.
• The CIA exam point is accountability. A live change may be necessary, but the organization should still show who accepted the risk and how it prevented or detected error.