mediumMultiple Choice
CISA Practice Question: An organization's IT policy review cycle is set…
An organization's IT policy review cycle is set to every two years. However, a new regulation requires immediate changes to data retention policies. What is the best course of action?
⚠ Common exam trap
CISA often tests whether candidates understand that policy review cycles are administrative schedules, not legal shields — the trap is choosing 'wait for the review' or 'change the cycle' instead of recognizing that urgent regulatory drivers require an immediate, documented exception.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the policy immediately through an exception process
When a new regulation mandates immediate changes to data retention policies, the policy must be updated right away rather than waiting for the scheduled two-year review. Using an exception process allows the organization to deviate from the standard review cycle, make the required changes promptly, and remain compliant while still preserving the formal change-control discipline. This balances regulatory urgency with governance integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduce the review cycle to annually
Why it's wrong here
Reducing the cycle to annually still leaves the new retention requirements unimplemented until the next scheduled review, so the immediate regulatory change is missed. Periodic cycle tuning suits planned governance cadence, not urgent legal mandates, which call for an out-of-cycle policy revision now.
- ✓
Update the policy immediately through an exception process
Why this is correct
When a new regulation demands immediate data retention changes, the policy must be updated now rather than waiting for the two-year cycle. Using the exception process allows the change to be made, reviewed and documented outside the standard schedule while maintaining governance.
- ✗
Wait until the next scheduled review to make changes
Why it's wrong here
Waiting until the next review delays compliance, breaching the regulation in the interim and risking sanctions. It is tempting because the review cycle is the established governance mechanism, so following it seems orderly, but immediate regulatory mandates require out-of-cycle policy updates.
- ✗
Ignore the regulation until the review
Why it's wrong here
Ignoring the regulation leaves the organisation non-compliant and exposed to legal penalties, regardless of the review schedule. It is tempting because the two-year cycle is the documented process, so deferring changes appears consistent with policy, yet regulatory obligations override internal review timing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.