CISA Practice Question: Information Systems Acquisition, Development, and Implementation
In the context of ITIL change management, which change type requires approval from the Change Advisory Board (CAB)?
⚠ Common exam trap
CISA often tests the misconception that all changes require CAB approval, but standard changes are pre-approved and emergency changes use an ECAB or delegated authority, so only normal changes go to the full CAB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Normal change
In ITIL change management, a 'Normal change' is any change that is not a standard (pre-approved) change and is not urgent enough to be an emergency change. Normal changes must be assessed, evaluated, and authorized by the Change Advisory Board (CAB) before implementation. The CAB reviews the change's risk, impact, and resource requirements to decide whether to approve, reject, or defer it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Emergency change
Why it's wrong here
Emergency changes are fast-tracked by an Emergency CAB or delegated authority so restoration can begin immediately; full CAB review would defeat that purpose. The ECAB convenes specifically for high-impact incidents needing urgent remediation. Standard CAB approval applies to normal changes, which follow the full assessment and scheduling cycle.
- ✓
Normal change
Why this is correct
Normal changes are non-standard, requiring a full assessment and authorisation process due to their potential impact and risk. Consequently, these changes necessitate formal evaluation and approval by the Change Advisory Board (CAB). The CAB's primary function is to assess the proposed change, its risks, and benefits, ensuring all stakeholders are considered before authorising its implementation, directly addressing the stem's criterion for CAB approval.
- ✗
Minor change
Why it's wrong here
Minor change is not an ITIL change type; ITIL classifies changes as standard, normal and emergency. A low-impact normal change still follows the change model and may be approved by delegated authority rather than the full CAB. The CAB approves normal changes, which require assessment, authorisation and scheduling.
- ✗
Standard change
Why it's wrong here
Standard changes are pre-authorised because their risk is low and the procedure is documented and repeatable, so they bypass CAB review entirely. CAB approval is reserved for normal changes, which carry sufficient risk or impact to need assessment and scheduling. A standard change would only reach the CAB if it breached its pre-approved scope.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.