Which of the following would be of GREATEST concern to an IS auditor evaluating an...

The best answer is C. Changes are approved after being moved to production.

ISACA guidance on change management emphasizes reviews, testing, approvals, and segregation of duties before moving changes forward. If changes are moved into production before approval, the organization has effectively bypassed one of the most important preventive controls in the change process. That creates direct risk of unauthorized, untested, or harmful changes reaching production.

Option A is a documentation weakness. Option B reduces efficiency and prioritization discipline. Option D is a concern for emergency changes, but it is still less severe than routinely approving changes only after implementation. In audit terms, post-production approval represents a fundamental control breakdown.

References (Official ISACA):

ISACA Journal, Speeding Up Software Delivery With Effective Change Management.