How should internal audit change control fields in an audit management system?

Treat the change as a governed configuration change. Start by defining the business purpose of the field, the owner, allowed values, required status, downstream reports, workflows, and approval path. Then export the baseline data, map old-to-new values, test the migration, validate reports, and retain evidence.

The key is not whether an administrator can technically add or rename a field. The key is whether the change preserves control-library integrity, audit reporting, issue tracking, and historical comparability.

For CIA exam purposes, choose the answer that builds governance around the field change rather than treating it as an informal system preference.