Information Systems Acquisition, Development, and Implementation →mediumMultiple ChoiceObjective-mapped

CISA Practice Question: Information Systems Acquisition, Development, and Implementation

During a system development project, the IS auditor notes that code reviews are performed only after the code is unit tested. Which of the following is the MOST significant risk associated with this practice?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Defects may be discovered later in the development lifecycle, increasing rework costs

Code reviews should be performed before unit testing to catch defects early. Delaying reviews until after testing may lead to rework if issues are found, increasing costs and time.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Code reviews may be less effective because developers are reluctant to critique tested code
Why it's wrong here
While there may be psychological factors, the main risk is inefficiency from late defect detection.
✓
Defects may be discovered later in the development lifecycle, increasing rework costs
Why this is correct
Detecting defects later is more expensive and time-consuming.
✗
Unit tests may mask code quality issues
Why it's wrong here
Unit tests verify functionality, not code quality or style.
✗
The code review process may overlook security vulnerabilities
Why it's wrong here
Security vulnerabilities can be found at any stage; the timing of review does not directly impact effectiveness.

Go deeper

CISA Practice Question: Information Systems Acquisition, Development, and Implementation

Why each option matters

Option-by-option breakdown

Related to this question