easyMultiple Choice
CISA Practice Question: Is the BEST control to ensure that system changes…
Which of the following is the BEST control to ensure that system changes are authorized?
⚠ Common exam trap
Test-takers frequently confuse detective controls (audit trails) or technical controls (version control) with the governance-based authorization control (CAB approval), leading them to select a control that records or manages changes rather than one that formally authorizes them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change advisory board approval
The change advisory board (CAB) is the primary control for authorizing system changes because it provides a formal, documented approval process before any change is implemented. This ensures that changes are reviewed by stakeholders with appropriate authority, reducing the risk of unauthorized or poorly planned modifications. Without CAB approval, there is no definitive authorization step, making it the best control for ensuring authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change advisory board approval
Why this is correct
A change advisory board reviews each request against business, risk and technical criteria before approving it, creating documented authorisation independent of the person requesting the change. This segregation of duties satisfies the stem's requirement that changes be authorised, unlike testing or logging, which detect rather than approve.
- ✗
Audit trail of all changes
Why it's wrong here
An audit trail records who changed what and when, but it is detective and after the fact; it cannot prevent an unauthorised change from being implemented. It is tempting because it supports accountability and review, and it would be correct where the requirement is to reconstruct or investigate changes.
- ✗
Segregation of duties between developers and operators
Why it's wrong here
Segregation of duties stops one person from both writing and promoting code, yet it does not itself require documented approval of each change. It is tempting because it reduces fraud and error risk, and it would be the right control where the concern is preventing a single individual from completing an entire transaction.
- ✗
Version control system
Why it's wrong here
Version control tracks and stores revisions, but it does not enforce approval before a change is promoted; a developer can commit freely. It is tempting because it underpins change management by recording history, and it would be the right control for maintaining baselines or enabling rollback.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.