The best answer is C. Changes are approved after being moved to production.
ISACA guidance on change management emphasizes reviews, testing, approvals, and segregation of duties before moving changes forward. If changes are moved into production before approval, the organization has effectively bypassed one of the most important preventive controls in the change process. That creates direct risk of unauthorized, untested, or harmful changes reaching production.
Option A is a documentation weakness. Option B reduces efficiency and prioritization discipline. Option D is a concern for emergency changes, but it is still less severe than routinely approving changes only after implementation. In audit terms, post-production approval represents a fundamental control breakdown.
References (Official ISACA):
* ISACA Journal, Speeding Up Software Delivery With Effective Change Management.

The best answer is C. Periodically restoring backup media for key databases.
ISACA guidance is very clear that backup restoration should be tested periodically. A backup is only useful if it can actually be restored successfully within business needs. Organizations sometimes assume that because backups exist, recovery is assured, but ISACA specifically warns that recovery procedures and restoration capability must be tested.
Option A is important for resilience, but offsite storage does not prove the backup is recoverable. Option B helps administration and tracking, but inventory alone does not validate restorability. Option D protects confidentiality of backup data, but it does not ensure successful recovery. The strongest control for recoverability is periodic test restoration.
References (Official ISACA):
* ISACA, Ensuring Data Security: The Importance of Cloud Backups and Drill Testing
* ISACA Journal, Governance of Key Aspects of System Patch Management - recommends periodic testing of backup restoration.
* ISACA Journal, IS Audit Basics: Backup and Recovery

If an IS audit reveals that an organization is not proactively addressing known vulnerabilities, the IS auditor should recommend that the organization assess the security risks to the business first, as this would help to prioritize the vulnerabilities based on their impact and likelihood, and determine the appropriate mitigation strategies. Verifying the disaster recovery plan (DRP) has been tested, ensuring the intrusion prevention system (IPS) is effective, and confirming the incident response team understands the issue are important steps, but they are not as urgent as assessing the security risks to the business. References: CISA Review Manual (Digital Version), Chapter 5, Section 5.6