hardMultiple Choice

CISA Practice Question: Based on the exhibit, what should the IS auditor…

Exhibit

Refer to the exhibit.
```
Change Management Log Extract:
CR-2024-001: Approved | Implemented 01/15 14:00
CR-2024-002: Approved | Implemented 01/20 09:30
CR-2024-003: Emergency (post-approved) | Implemented 01/25 22:15
CR-2024-004: Approved | Implemented 02/01 11:00
CR-2024-005: Emergency (post-approved) | Implemented 02/10 23:45
CR-2024-006: Approved | Implemented 02/15 10:00
CR-2024-007: Emergency (post-approved) | Implemented 02/20 21:30
```

Based on the exhibit, what should the IS auditor MOST likely recommend?

⚠ Common exam trap

ISACA often tests the misconception that the IS auditor should immediately block all direct production access or require all changes to go through standard approval, when the real issue is ensuring proper classification and enforcement of the emergency change process.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Review the criteria for emergency changes and enforce proper classification

The exhibit shows changes classified as 'emergency' bypassing the standard approval process. The IS auditor's primary concern is that emergency changes may be misclassified to avoid proper review, increasing risk. Option D is correct because it addresses the root cause: reviewing the criteria for emergency changes and enforcing proper classification ensures that only truly urgent changes bypass standard controls, while all others follow the required approval path.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Investigate whether any changes are missing from the log
Why it's wrong here
The exhibit already lists the changes, so investigating for missing entries addresses a completeness question the evidence does not raise. This is tempting because log completeness is a genuine audit concern, and it would be correct if the log's total count disagreed with the change-management system's records.
✗
Immediately block all direct production access for developers
Why it's wrong here
Blocking all developer production access is a disproportionate control that would halt legitimate support work, and the exhibit shows no unauthorised access. It is tempting because removing standing production privileges is a valid remediation when developers hold unnecessary persistent access, which the evidence here does not establish.
✗
Require all changes to go through the standard approval process
Why it's wrong here
Routing every change through standard approval ignores the exhibit's evidence that emergency changes were properly authorised retrospectively; the gap is logging completeness, not the approval path. Standard approval is the right recommendation when changes bypass authorisation entirely, which the exhibit does not show.
✓
Review the criteria for emergency changes and enforce proper classification
Why this is correct
Emergency changes bypass normal approval, so auditors should verify that classification criteria are defined and consistently applied. Reviewing those criteria and enforcing proper classification prevents unjustified use of the expedited path, directly addressing the control weakness the exhibit reveals.

Go deeper

CISA Practice Question: Based on the exhibit, what should the IS auditor…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question