CISA Governance and Management of IT Practice Question
Exhibit
Refer to the exhibit. The following is an excerpt from an IT control self-assessment report: Control: Segregation of duties in system development Finding: In 3 out of 10 projects, the same developer who wrote code also performed code review. Risk: High Planned Remediation: Implement automated code review tool by Q3.
What is the MOST significant weakness in the planned remediation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The remediation may not eliminate the segregation of duties issue.
The planned remediation (e.g., an automated code review tool) does not ensure that the developer who writes the code is different from the person who reviews it. This fails to address the root cause of segregation of duties, making it the most significant weakness. Options A, C, and D are either less critical or not as directly related to the core issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The remediation only addresses a subset of projects.
Why it's wrong here
The tool could be applied to all projects; the plan does not specify limiting scope.
- ✓
The remediation may not eliminate the segregation of duties issue.
Why this is correct
An automated tool does not prevent the same developer from performing both coding and review if they run the tool.
- ✗
The remediation relies on technology rather than process.
Why it's wrong here
While relevant, the primary issue is that the tool does not enforce segregation.
- ✗
The remediation does not include a compensating control.
Why it's wrong here
Lack of compensating control is a concern but not the most significant weakness.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.