An internal auditor discovered that several unauthorized modifications were made to the production version of...

Unauthorized modifications to a production application are best described as a change controls weakness. Change controls are designed to ensure that application modifications are requested, authorized, tested, approved, documented, and migrated to production in a controlled manner. If unauthorized changes reach production, the organization may face processing errors, financial misstatements, fraud, system instability, and audit trail gaps. Production controls and application controls may be affected, but the direct deficiency is the failure of change management. Authorization controls are part of the issue, but the broader control category is change control. Internal auditors should examine developer access, migration procedures, emergency changes, version control, segregation of duties, and post-implementation review. Therefore, Option D is correct.