How to Confirm Change Log Completeness in CISA Audits?

CISA By islever Editorial Last updated Sep 9, 2026

Short answer

B Trace a recent modification directly from the production environment to the change log to verify that all system events are properly recorded.

Question

An IS auditor evaluating the change management process must select a sample from the change log. What is the BEST way for the auditor to confirm the change log is complete?

Obtain management attestation of completeness.
Take the last change from the system and trace it back to the log. Correct Answer
Take an item from the log and trace it back to the system.
Interview change management personnel about completeness.

Key Takeaways

The question tests the difference between completeness and existence assertions, where candidates often confuse forward tracing with backward vouching.

Testing change log completeness requires forward tracing from live system events to documentation. This guide confirms why option B is the correct audit procedure over backward vouching.

Common mistake: Candidates frequently select C because they mistakenly believe sampling from the log verifies accuracy, overlooking that this direction only proves recorded items actually occurred.

Expert Analysis

Why the Answer Is Correct

Forward tracing from the source data to the audit trail records is the standard method for testing completeness. By selecting a recent change directly from the production environment and verifying its presence in the change log, the auditor demonstrates that the logging mechanism captures events as they happen. This approach aligns with ISACA’s audit doctrine on substantive testing and procedural controls.

Why the Other Options Are Wrong

Option C performs backward tracing, which validates existence or accuracy rather than completeness. Option A relies on subjective management claims, which lack independent evidential weight. Option D gathers anecdotal information through inquiry, which is insufficient as standalone audit evidence for process validation.

Community Comment Notes

Some learners argue that sampling multiple log entries provides broader coverage, yet this misunderstands the specific assertion being tested. As one commenter noted, checking the most recent system change proves the logging process remains active and timely. Another user emphasized that forward tracing guarantees captured updates, which directly addresses the completeness objective.

Exam Strategy

Always identify the specific audit assertion before choosing your testing direction. Map completeness to source-to-record tracing, and reserve record-to-source tracing for existence or accuracy checks.

Frequently Asked Questions

Why does tracing from the log to the system fail here?

That direction tests existence or accuracy, not completeness. Completeness requires proving nothing was omitted by starting with the actual event.

Does checking only the last change prove full log completeness?

It validates that the logging process is active and capturing updates in real time, which satisfies the immediate audit objective for completeness.

More CISA FAQ →

Community Votes

80%

20%

80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

46080f2 👍 1 Answered B

Here, the auditor identifies the most recent change made in the system and checks whether it is recorded in the change log. If the last change is present, it indicates that the log is being updated in a timely manner, suggesting that the change management process is capturing changes as they occur. While this doesn’t prove that every single change throughout the log’s history is recorded—since earlier entries could still have omissions—it provides a practical starting point. Confirming the latest change is logged offers some evidence that the process is functioning and current, which is a stronger indicator of completeness than reliance on statements alone.
pLulu 👍 1

B. Take the last change from the system and trace it back to the log. This method ensures that the change log accurately reflects all changes made in the system. By tracing the last change from the system back to the log, the auditor can verify that the log is capturing all changes as they occur. C. Take an item from the log and trace it back to the system: This approach confirms that specific logged changes are valid but does not ensure that all changes are logged.
blehbleh 👍 1 Answered C

This should be C, B just checks the most recent change whereas option C allows the auditor to check any changes giving a better sample selection into the change log.
PurpleParrot 👍 3 Answered B

B is the right answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide