When reviewing procedures for emergency changes to programs, the IS auditor should verify that
the procedures:

A.
allow changes, which will be completed using after-the-fact follow-up.

B.
allow undocumented changes directly to the production library.

C.
do not allow any emergency changes.

D.
allow programmers permanent access to production programs.

Explanation:
There may be situations where emergency fixes are required to resolve system problems. This
involves the use of special logon IDs that grant programmers temporary access to production
programs during emergency situations. Emergency changes should becompleted using after-thefact follow-up procedures, which ensure that normal procedures are retroactively applied; otherwise,
production may be impacted. Changes made in this fashion should be held in an emergency library
from where they can be moved to the production library, following the normal change management
process. Programmers should not directly alter the production library nor should they be allowed
permanent access to production programs.