Exam Therapy — CISA Domain 3: Change Control, CAB, and SDLC (a.k.a. The Paperwork That Saves Production)

Andrew and Ava unpack CISA Domain 3’s classic traps: why a CAB signature isn’t “control,” what evidence auditors actually need, and how SDLC controls change by phase (even in Agile). Plus: emergency changes, rollback plans, and the exam’s love of wording you’ll hate at 1:00 a.m.