Ironically, the same change management procedures IS organizations must adhere to in order
to maintain compliance with prescribed control procedures under SOX would require proper
testing and authorization of the auditor’s changes to the systems since the changes impact the
processes related to financial information and financial reporting. Should the auditors abide by a
different set of rules and be exempt from such quality assurance testing? If not, who would be
responsible for enforcing the change management procedures and documentation?