CISA Practice Question: Information Systems Operations and Business Resilience
During a change management process review, an IS auditor finds that the change advisory board (CAB) approved a change that subsequently caused a major service outage. The change was classified as 'normal' with no emergency. What is the auditor's primary concern?
⚠ Common exam trap
The trap here is that candidates may focus on operational details (like testing or classification) rather than the governance failure of the CAB's impact assessment, which is the core audit concern in change management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CAB did not adequately assess the potential impact of the change.
The primary concern is that the CAB approved a 'normal' change without adequately assessing its potential impact, leading to a major service outage. In ITIL-based change management, the CAB is responsible for evaluating the risk, impact, and resource requirements of a change before approval. A failure in this assessment indicates a breakdown in the change management process, which is the core issue an IS auditor must address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The service desk was not notified of the change.
Why it's wrong here
Notification is important but not the primary concern.
- ✓
The CAB did not adequately assess the potential impact of the change.
Why this is correct
The outage suggests the CAB failed to identify risks.
- ✗
The change should have been classified as emergency.
Why it's wrong here
There is no indication it was an emergency; the concern is about the CAB's review.
- ✗
The change was not tested in a pre-production environment.
Why it's wrong here
While testing is important, the primary concern is the CAB's approval process.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.