CISA Practice Question: Information Systems Acquisition, Development, and Implementation
During a system development project, the IS auditor notes that code reviews are performed only after the code is unit tested. Which of the following is the MOST significant risk associated with this practice?
⚠ Common exam trap
CISA often tests the principle that early detection reduces cost — candidates who focus on cultural or security-specific concerns miss the broader lifecycle cost risk that is the primary audit concern.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defects may be discovered later in the development lifecycle, increasing rework costs
Performing code reviews only after unit testing delays defect detection to a later stage in the development lifecycle, when rework costs are significantly higher. Code reviews are most effective when conducted early, before testing, because they catch design flaws, logic errors, and security issues at the source. The later a defect is found, the more expensive and time-consuming it is to fix, especially if it has propagated to other modules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Code reviews may be less effective because developers are reluctant to critique tested code
Why it's wrong here
Reviews occurring after unit testing mean defects are found once code is already validated as working, so reviewers anchor on passing tests rather than design flaws. It is tempting because post-testing review suits regression-focused audits, yet the risk is that architectural and requirement defects escape before testing locks in behaviour.
- ✓
Defects may be discovered later in the development lifecycle, increasing rework costs
Why this is correct
Reviewing code only after unit testing delays defect detection until later lifecycle stages, when remediation requires reworking tested components and dependent code. Defects found earlier during review are cheaper to fix, so this sequencing inflates rework cost and schedule risk.
- ✗
Unit tests may mask code quality issues
Why it's wrong here
Unit testing verifies functional behaviour of individual units; it does not assess code quality attributes such as maintainability or adherence to standards, which is precisely what review addresses. The greater risk is that defects and security flaws pass into later stages undetected.
- ✗
The code review process may overlook security vulnerabilities
Why it's wrong here
Reviews performed after unit testing still examine the code, so security vulnerabilities remain detectable; the practice does not inherently cause them to be overlooked. The genuine risk is that review occurs too late, after defects are embedded and rework costs rise.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.