セクション：情報システムの取得、開発、導入

The best answer is C. Changes are approved after being moved to production.
ISACA guidance on change management emphasizes reviews, testing, approvals, and segregation of duties before moving changes forward. If changes are moved into production before approval, the organization has effectively bypassed one of the most important preventive controls in the change process. That creates direct risk of unauthorized, untested, or harmful changes reaching production.
Option A is a documentation weakness. Option B reduces efficiency and prioritization discipline. Option D is a concern for emergency changes, but it is still less severe than routinely approving changes only after implementation. In audit terms, post-production approval represents a fundamental control breakdown.
References (Official ISACA):
* ISACA Journal, Speeding Up Software Delivery With Effective Change Management.

Comprehensive and Detailed In-Depth Explanation:IT application owners having sole responsibility for architecture approval (B) is a major concern because it indicates a lack of oversight and segregation of duties.
EA decisions should be reviewed by a cross-functional governance body to ensure alignment with security, compliance, and business objectives.
Other options:
* The CIO chairing the review board (A) may indicate centralized leadership but is not inherently a risk.
* EA governing non-IT projects (C) may indicate scope expansion but is not a security risk.
* Security requirements being reviewed (D) is a best practice and not a concern.
Reference: ISACA CISA Review Manual, IT Governance and Management of IT

セクション：情報システムの監査プロセス