CISA Practice Question: Information Systems Acquisition, Development, and Implementation

An IS auditor is reviewing change management procedures. Which of the following situations would be of GREATEST concern?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

An emergency change was implemented and not reviewed after resolution

Emergency changes bypass normal controls; without post-change review, unauthorized or flawed changes may persist unnoticed.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A standard change was implemented without CAB approval
Why it's wrong here
Standard changes are pre-approved; CAB approval may not be required.
✓
An emergency change was implemented and not reviewed after resolution
Why this is correct
Post-review ensures emergency changes are documented and validated.
✗
The change request did not include an impact analysis
Why it's wrong here
Missing impact analysis is significant but emergency change lack of review is greater.
✗
A normal change had a rollback plan that was not tested
Why it's wrong here
Untested rollback is a risk but less critical than lacking post-review for emergency changes.

Go deeper