CISA Protection of Information Assets Practice Question
During a review of the patch management process, the IS auditor finds that critical security patches are applied within 30 days, but the policy requires application within 7 days. The IT manager argues that the delay is due to testing requirements. What should the auditor recommend?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require risk acceptance documentation for each patch that misses the SLA
The best course is to document the risk acceptance for each delayed patch, ensuring management is aware and accepts the risk. This formalizes the deviation and maintains accountability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Escalate to senior management immediately
Why it's wrong here
Escalation may be premature; the auditor should first recommend a process for risk acceptance.
- ✗
Update the policy to allow 30 days for critical patches
Why it's wrong here
Changing policy to match practice may reduce the security posture without justification.
- ✓
Require risk acceptance documentation for each patch that misses the SLA
Why this is correct
This ensures management formally accepts the residual risk.
- ✗
Accept the delay as necessary for stability
Why it's wrong here
Accepting without documentation leaves the risk unmanaged.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.