Ineffective change management is indicated by poor impact analysis, increased production issues, and frequent emergency changes. If IT management cannot predict how changes affect interdependent systems or business processes, change risk assessment is weak. Increased trouble calls or programmer support hours suggest changes are causing defects, instability, or user disruption. Frequent emergency changes that bypass normal controls indicate inadequate planning, testing, or release management. A lack of turnover in systems support and business analyst groups is not a negative indicator; stability may actually support institutional knowledge. Internal auditors reviewing change management should evaluate authorization, testing, segregation of duties, migration controls, emergency change approval, backout plans, and post-implementation review. Therefore, items 1, 2, and 4 are correct, making Option C the answer.