As long as the IT Audit director meets AT §101.51, they should have the ability to reject any change. If the IT audit director can provide sufficient evidence to prove a reasonable basis for wanting to delay implementation of a change, she should have that power. With that said, there needs to be a policy in place to govern changes to production. Changes need to be properly evaluated and authorized before implemented. This is not an appropriately designed control procedure. The IT Audit Director should have to report her findings back to management before taking action against a change that management has already approved (see: ISACA S7). I think this control gives the IT Audit Director too much power over operational changes.
According to
According to