When reviewing procedures for emergency changes to programs, the IS auditor should verify that the procedures:
A.
allow changes, which will be completed using after-the-fact follow-up.
B.
allow undocumented changes directly to the production library.
C.
do not allow any emergency changes.
D.
allow programmers permanent access to production programs.
Explanation:
There may be situations where emergency fixes are required to resolve system problems. This involves the use of special logon IDs that grant programmers temporary access to production programs during emergency situations. Emergency changes should becompleted using after-the- fact follow-up procedures, which ensure that normal procedures are retroactively applied; otherwise, production may be impacted. Changes made in this fashion should be held in an emergency library from where they can be moved to the production library, following the normal change management process. Programmers should not directly alter the production library nor should they be allowed permanent access to production programs.