An IS auditor reviewing a database application discovers that the current configuration does not match the originally designed structure. Which of the following should be the IS
auditor’s next action?

A.
Analyze the need for the structural change.

B.
Recommend restoration to the originally designed structure.

C.
Recommend the implementation of a change control process.

D.
Determine if the modifications were properly approved.

Explanation:
An IS auditor should first determine if the modifications were properly approved. Choices A, B and C are possible subsequent actions, should the IS auditor find that the structural modification had not been approved.