問題文
A payroll bureau makes three changes to its anomaly detection solution in one month: it retrains the model on the latest six months of payroll runs, it adjusts the instruction text that the solution sends to a hosted language service, and it changes the provider's model version from one release to the next. An auditor asks which of these belongs in change management. Which answer is correct?
選択肢
- All three, because each one alters what the solution produces for the same input, and the control needed for each may differ in form without any of them being outside the scope.
- Only the third, because changing the provider's version replaces the underlying component while the other two adjust how the bureau's own solution uses it.
- The first only, since retraining alters the model's parameters and the other two leave the parameters untouched, which means the behavior of the model itself is unchanged and only the way it is called has been adjusted by the bureau's team.
- None of the three, because change management applies to the code and the infrastructure of a solution rather than to its data and its configuration, and all three of these are adjustments to data or configuration rather than to the software that the bureau has written and deployed.