An IS auditor reviewing a database application discovers that the current configuration does not match the
originally designed structure. Which of the following should be the IS auditor’s next action?

A.
Analyze the need for the structural change.

B.
Recommend restoration to the originally designed structure.

C.
Recommend the implementation of a change control process.

D.
Determine if the modifications were properly approved.

Explanation:
An IS auditor should first determine if the modifications were properly approved. Choices A, B and C are
possible subsequent actions, should the IS auditor find that the structural modification had not been approved.