CISA Governance and Management of IT Practice Question
Exhibit
Refer to the exhibit. Access Control Policy (Excerpt): - All system access requests must be approved by the data owner. - Access reviews must be performed quarterly. - Non-compliant access will be revoked within 24 hours of detection.
An auditor finds that access reviews have not been completed for two quarters. What is the MOST significant risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unauthorized access may be granted and persist
Access reviews are essential for detecting and revoking unauthorized or excessive permissions. Without them, unauthorized access may go undetected and persist, leading to potential security breaches. Option A is incorrect because while data integrity could be compromised as a secondary effect, the most direct risk is unauthorized access. Option C is incorrect: system performance is unrelated to access reviews. Option D is incorrect because reporting audit findings is a consequence, not the primary risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data integrity may be compromised
Why it's wrong here
Incorrect. Integrity risk is secondary to unauthorized access.
- ✓
Unauthorized access may be granted and persist
Why this is correct
Correct. Incomplete reviews allow inappropriate access to continue.
- ✗
System performance may degrade
Why it's wrong here
Incorrect. Unrelated to access reviews.
- ✗
Audit findings may be reported to management
Why it's wrong here
Incorrect. Reporting is a outcome, not the primary risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.