hardMultiple Choice
CISA Practice Question: An IS auditor is reviewing an organization's…
An IS auditor is reviewing an organization's change management process. The auditor notes that all emergency changes are approved post-implementation by the change advisory board (CAB) within 48 hours. Which of the following is the auditor's BEST course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assess whether the emergency change policy includes proper justification and post-approval controls
The auditor's primary role is to assess the adequacy of controls. The emergency change process with post-approval within 48 hours is acceptable if the policy includes proper justification and post-approval controls. The auditor should evaluate whether these controls are in place rather than immediately escalating or recommending pre-approval, which may not be practical for emergencies. Option D is incorrect because pre-approval for emergency changes is not always feasible, and the current process may be adequate with proper controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate the issue to senior management as a control weakness
Why it's wrong here
Post-implementation CAB approval within 48 hours is a recognised compensating control for emergency changes, so escalating it as a weakness misstates the finding. It is tempting because approval after deployment appears to bypass pre-approval, and escalation would be correct if no retrospective review occurred at all.
- ✗
Verify that all emergency changes are tested before implementation
Why it's wrong here
Testing every emergency change before implementation is often impossible when the change fixes a live outage, so demanding it universally is impractical. It is tempting because testing is a genuine control, and it would be the right focus for routine changes, where pre-implementation verification is expected.
- ✓
Assess whether the emergency change policy includes proper justification and post-approval controls
Why this is correct
Post-implementation approval is acceptable only if compensating controls exist, so the auditor must verify that the emergency change policy mandates documented justification and retrospective CAB review. Assessing those controls determines whether the 48-hour approval process provides adequate governance.
- ✗
Recommend that emergency changes be approved prior to implementation
Why it's wrong here
Requiring prior CAB approval contradicts the definition of an emergency change, which by nature cannot wait for the board to convene. It is tempting because pre-approval is the correct control for normal and standard changes, where the CAB can review risk before deployment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.