CISA Protection of Information Assets Practice Question
During a review of the patch management process, the IS auditor finds that critical security patches are applied within 30 days, but the policy requires application within 7 days. The IT manager argues that the delay is due to testing requirements. What should the auditor recommend?
⚠ Common exam trap
CISA often tests the distinction between the auditor's role and management's role, so the trap is choosing escalation or policy relaxation when the correct answer is to require formal risk acceptance by the business owner, preserving auditor independence and the control baseline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require risk acceptance documentation for each patch that misses the SLA
The policy requires 7-day patching but actual practice is 30 days, creating a documented control gap. Rather than silently accepting the deviation or weakening the standard, the auditor should recommend that each missed SLA be formally documented as a risk acceptance so management owns the residual risk. This preserves the control baseline while providing an auditable trail of conscious risk decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate to senior management immediately
Why it's wrong here
Escalation bypasses the auditor's first duty: verify whether testing genuinely requires 30 days and whether the 7-day policy is achievable. Raising to senior management suits repeated, unaddressed non-compliance after remediation attempts; here the finding is fresh and the manager's testing claim is untested, so a recommendation precedes escalation.
- ✗
Update the policy to allow 30 days for critical patches
Why it's wrong here
Lowering the threshold to 30 days codifies the existing control gap rather than closing it, leaving critical vulnerabilities exploitable for three extra weeks. Policy revision suits environments where vendor testing genuinely cannot compress the window, but here the auditor's mandate is to enforce the 7-day requirement, not legitimise the deviation.
- ✓
Require risk acceptance documentation for each patch that misses the SLA
Why this is correct
Where testing causes patches to breach the seven-day SLA, documented risk acceptance transfers accountability to business owners for the residual exposure during the delay. This satisfies the stem's compliance gap by ensuring deviations are formally acknowledged rather than silently tolerated, without abandoning the testing control.
- ✗
Accept the delay as necessary for stability
Why it's wrong here
Accepting the delay treats an unverified claim as justification, leaving the 7-day control unevidenced and critical exposures open for 23 extra days. Tolerating slippage fits low-risk, non-exploitable patches where compensating controls exist; here the policy mandates 7 days and the testing rationale must be validated, not assumed.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.