Information Systems Acquisition, Development, and Implementation →mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is reviewing change management procedures and finds that standard changes are approved by the change manager without CAB review. What is the auditor's BEST conclusion?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
This is acceptable provided that standard changes are clearly defined and low-risk
Standard changes are pre-approved, low-risk changes that do not require CAB review. This is acceptable if the criteria for standard changes are properly defined.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
This is acceptable provided that standard changes are clearly defined and low-risk
Why this is correct
ITIL allows standard changes to be handled via a pre-approved process to improve efficiency.
- ✗
The change manager should be a member of the CAB
Why it's wrong here
The change manager may or may not be on CAB, but that is not relevant to standard changes.
- ✗
The auditor should recommend that all changes go through CAB
Why it's wrong here
Requiring CAB for standard changes would be inefficient and unnecessary.
- ✗
This is a control weakness because all changes should be reviewed by the CAB
Why it's wrong here
Standard changes are by definition pre-approved and do not need CAB involvement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.