CISA Governance and Management of IT Practice Question
Exhibit
Refer to the exhibit. The following is a RACI matrix for the change management process: Activity: Change request approval Responsible: Change Manager (R) Accountable: IT Director (A) Consulted: Business Process Owner (C) Informed: IT Operations (I)
Which of the following is a potential risk in this RACI matrix?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Change Manager is responsible but lacks authority to approve.
The Change Manager is responsible but lacks authority to approve. In a RACI matrix, the Responsible (R) party performs the work, while the Accountable (A) party is ultimately answerable and has approval authority. If the Change Manager is marked as Responsible for change approval without being Accountable, there is a risk that they may not have the proper authority to approve changes, leading to potential unauthorized changes. Option A is not necessarily a risk because being Accountable does not require being informed of all changes. Option B: IT Operations being informed is appropriate; they do not need to be Responsible for implementation. Option C: The Business Process Owner being consulted is normal and may cause delays but is not as critical as the authority issue. Thus, D is the most significant risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IT Director is accountable but not informed of all changes.
Why it's wrong here
The Accountable person does not need to be informed of every change; they remain accountable.
- ✗
IT Operations is informed, but should be responsible for implementation.
Why it's wrong here
IT Operations is informed, which is appropriate; implementation responsibility is a separate activity.
- ✗
The Business Process Owner is consulted, which may delay approvals.
Why it's wrong here
Consultation is appropriate and does not necessarily cause delays.
- ✓
The Change Manager is responsible but lacks authority to approve.
Why this is correct
If the Change Manager is responsible but not accountable, they may not have approval authority, leading to bypassed controls.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.