mediumMultiple ChoiceObjective-mapped
CISA Practice Question: An IT auditor is reviewing the change management…
An IT auditor is reviewing the change management process for a financial application. The auditor finds that emergency changes are frequently implemented without post-implementation review. What is the MOST significant risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security vulnerabilities may be introduced and remain undetected
The most significant risk of implementing emergency changes without post-implementation review is that security vulnerabilities may be introduced and remain undetected (Option C). Without review, there is no assurance that the change did not compromise security controls, potentially exposing the application to threats. While other concerns such as lack of documentation (A), potential outages (B), or user notification (D) are important, they are not as critical as the undetected introduction of security vulnerabilities, which could have long-term impacts on data integrity and confidentiality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The change may not be documented properly
Why it's wrong here
Documentation is important but the primary risk is undetected security or stability issues.
- ✗
The change may cause an outage during the next backup cycle
Why it's wrong here
Possible but less likely than the systemic risk of unmitigated vulnerabilities.
- ✓
Security vulnerabilities may be introduced and remain undetected
Why this is correct
Emergency changes bypass normal controls, and lack of review means any flaws are not corrected promptly.
- ✗
Users may not be notified of the change
Why it's wrong here
Communication is important but not the most significant risk compared to security.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.