CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is reviewing change management procedures. Which of the following situations would be of GREATEST concern?
⚠ Common exam trap
CISA often tests the distinction between process-documentation weaknesses (missing impact analysis, untested rollback) and control-bypass weaknesses (unreviewed emergency change) — candidates pick the more 'visible' documentation gap instead of the actual loss of control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An emergency change was implemented and not reviewed after resolution
An emergency change bypasses the normal CAB review and testing gates, so the only compensating control is a mandatory post-implementation review (PIR) to confirm the change worked, assess side effects, and retroactively authorize it. If that review never happens, the change remains unauthorized and unverified, leaving a permanent gap in the change management audit trail. This is the greatest concern because it defeats the entire purpose of the emergency-change exception.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A standard change was implemented without CAB approval
Why it's wrong here
Standard changes are pre-approved by definition, with a documented, low-risk, repeatable procedure; implementing one without a fresh CAB review is normal and expected. It is tempting to flag as a control breach, but the genuine concern is a change reaching production without impact analysis or authorisation.
- ✓
An emergency change was implemented and not reviewed after resolution
Why this is correct
Emergency changes bypass normal review, so the absence of post-implementation review leaves the change permanently unverified, with no confirmation it was authorised, tested, or documented. This defeats the control's compensating mechanism and represents the greatest change management concern.
- ✗
The change request did not include an impact analysis
Why it's wrong here
Missing impact analysis means the change's risks, dependencies and effects were never assessed before approval, so unauthorised or harmful changes can reach production. Other gaps are narrower. Impact analysis is tempting to overlook because changes may still be tested and approved, but without it approval decisions lack the basis for informed risk acceptance.
- ✗
A normal change had a rollback plan that was not tested
Why it's wrong here
An untested rollback plan for a normal change is a weakness, yet the change still passed approval, testing and authorisation; the rollback gap is a residual risk rather than a bypass of control. It is tempting because rollback failures cause outages, but auditors rank unauthorised or unassessed changes above untested contingency plans.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.