CISA Practice Question: Information Systems Operations and Business Resilience
An IS auditor is reviewing the change management process and notices that several emergency changes were implemented without post-implementation review. What is the PRIMARY concern?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Changes may not be properly documented
Emergency changes bypass normal controls, so post-implementation review is critical to ensure the change was effective and did not introduce risks. Without it, undocumented or unauthorized changes may persist.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The change may have caused an outage
Why it's wrong here
While possible, the primary concern is lack of documentation and control, not necessarily an outage.
- ✓
Changes may not be properly documented
Why this is correct
Without review, there is no verification that the change was documented correctly, which can lead to configuration drift.
- ✗
The change may have exceeded budget
Why it's wrong here
Budget is not the primary concern of post-implementation review.
- ✗
The change may have been unauthorized
Why it's wrong here
Emergency changes are authorized by a designated authority, but the post-review ensures compliance.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.