Watch this video on YouTube
What would an IS auditor use to determine if unauthorized modifications were made to production programs?