CISA Practice Question: Information Systems Acquisition, Development, and Implementation

Which of the following is the PRIMARY purpose of a change advisory board (CAB) in the change management process?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To assess, prioritize, and authorize changes

The CAB is responsible for reviewing and approving changes, assessing risks, and ensuring proper planning and testing.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To approve all standard changes without review
Why it's wrong here
A CAB reviews and authorises changes carrying risk or impact; standard changes are pre-approved through the change model, so routing them to the board defeats that pre-authorisation. It is tempting because the CAB is the visible approval body, but it would be correct for normal or significant changes requiring assessment.
✓
To assess, prioritize, and authorize changes
Why this is correct
The change advisory board's primary function is to assess each change's risk and impact, prioritise it against other changes, and authorise or reject it, satisfying the stem's focus on the change management process. Implementation and post-implementation review sit with other roles, not the CAB.
✗
To authorize emergency changes immediately
Why it's wrong here
Emergency changes bypass the scheduled CAB agenda and are authorised by an emergency change authority or delegated approver, so immediate authorisation is not the CAB's function. It is tempting because the CAB does approve changes, but its remit covers planned changes reviewed at scheduled meetings.
✗
To develop technical solutions for change requests
Why it's wrong here
A CAB evaluates, prioritises and approves or rejects change requests; it does not build the technical solution, which remains with the implementer. It is tempting because CAB members often include technical specialists, but their role is governance and risk assessment, not development.

Go deeper