CISA Practice Question: Information Systems Operations and Business Resilience
An IS auditor is reviewing change management for a financial application. Which TWO of the following findings would most likely indicate a control weakness?
⚠ Common exam trap
The trap here is that candidates may incorrectly consider emergency changes authorized only by the change manager as acceptable, but it is a control weakness because it bypasses proper segregation of duties and approval hierarchy. Even emergency changes should require authorization from a higher authority or be subject to post-implementation review.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regression testing is not performed for minor changes.
Regression testing ensures that code changes do not introduce new defects into existing functionality. Skipping regression testing for minor changes is a control weakness because even small modifications can have unintended side effects in a financial application where accuracy and reliability are critical. Without regression testing, the organization risks undetected errors that could lead to financial misstatements or system instability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Regression testing is not performed for minor changes.
Why this is correct
Even minor changes can have unintended impacts; regression testing should be considered.
- ✓
Emergency changes are authorized by the change manager only.
Why this is correct
Emergency changes should have a defined authorization process; sole approval by change manager may be inadequate.
- ✗
Normal changes are tested in a development environment before production.
Why it's wrong here
Testing in dev is appropriate.
- ✗
The change advisory board meets weekly to review all changes.
Why it's wrong here
Weekly meetings are typical.
- ✗
All changes are documented in a change log.
Why it's wrong here
Documentation is a good control.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.