mediumMultiple ChoiceObjective-mapped
CISA Practice Question: An IS auditor is reviewing the change management…
An IS auditor is reviewing the change management process for a financial application. Which of the following findings would be of MOST concern?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Emergency changes are not reviewed within 30 days
Emergency changes bypass normal controls; failure to review them within a reasonable time (e.g., 30 days) increases risk of undocumented changes. Logging in spreadsheet, pre-approved standard changes, and defined change windows are acceptable or even good practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change requests are logged in a spreadsheet
Why it's wrong here
Spreadsheets can be acceptable for small shops if properly controlled.
- ✗
Standard changes are pre-approved
Why it's wrong here
Pre-approval of standard changes is a common good practice.
- ✗
Change windows are defined in the policy
Why it's wrong here
Defining change windows is a control to minimize disruption.
- ✓
Emergency changes are not reviewed within 30 days
Why this is correct
Correct: Emergency changes require timely retroactive review to ensure proper authorization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IT auditor is reviewing the change management process for a financial application. The auditor finds that emergency changes are frequently implemented without post-implementation review. What is the MOST significant risk?
medium- A.The change may not be documented properly
- B.The change may cause an outage during the next backup cycle
- ✓ C.Security vulnerabilities may be introduced and remain undetected
- D.Users may not be notified of the change
Why C: The most significant risk of implementing emergency changes without post-implementation review is that security vulnerabilities may be introduced and remain undetected (Option C). Without review, there is no assurance that the change did not compromise security controls, potentially exposing the application to threats. While other concerns such as lack of documentation (A), potential outages (B), or user notification (D) are important, they are not as critical as the undetected introduction of security vulnerabilities, which could have long-term impacts on data integrity and confidentiality.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.