Watch this video on YouTube
Which audit technique would best assist an auditor in determining unauthorized program changes since the last authorized program update?