hardMultiple ChoiceObjective-mapped
CISA Practice Question: An IS auditor is reviewing an organization's…
An IS auditor is reviewing an organization's change management process. The auditor notes that all emergency changes are approved post-implementation by the change advisory board (CAB) within 48 hours. Which of the following is the auditor's BEST course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assess whether the emergency change policy includes proper justification and post-approval controls
The auditor's primary role is to assess the adequacy of controls. The emergency change process with post-approval within 48 hours is acceptable if the policy includes proper justification and post-approval controls. The auditor should evaluate whether these controls are in place rather than immediately escalating or recommending pre-approval, which may not be practical for emergencies. Option D is incorrect because pre-approval for emergency changes is not always feasible, and the current process may be adequate with proper controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate the issue to senior management as a control weakness
Why it's wrong here
The process may be acceptable; no evidence of weakness yet.
- ✗
Verify that all emergency changes are tested before implementation
Why it's wrong here
Testing is separate from authorization; the issue is approval timing.
- ✓
Assess whether the emergency change policy includes proper justification and post-approval controls
Why this is correct
The auditor should evaluate the adequacy of controls around the process.
- ✗
Recommend that emergency changes be approved prior to implementation
Why it's wrong here
Industry practice allows post-approval for emergencies if justified.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.