CISM Information Security Program Practice Question
During a security program review, the auditor finds that incident response procedures have not been tested in over two years. What is the MOST significant risk arising from this finding?
⚠ Common exam trap
CISM often tests the distinction between compliance risk and operational risk; candidates may pick 'non-compliance' because it sounds like an audit finding, but the MOST significant risk is always the actual security impact of an ineffective response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ineffective response leading to greater damage during an incident
The most significant risk of not testing incident response procedures for over two years is that the response will be ineffective when a real incident occurs, leading to greater damage, longer downtime, and potentially uncontrolled escalation. Untested procedures may contain outdated contacts, incorrect escalation paths, or missing steps, so the organization cannot rely on them. While compliance and cost are concerns, the primary security risk is the inability to contain and recover effectively, which directly increases business impact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Non-compliance with regulatory requirements
Why it's wrong here
Regulatory breach is possible only if a framework explicitly mandates periodic testing, which the stem does not state. The universal risk is degraded response capability: untested procedures leave roles, escalation paths and containment steps unverified, so real incidents cause longer dwell time and greater impact regardless of any compliance obligation.
- ✗
Higher financial costs due to inefficiencies
Why it's wrong here
Untested procedures primarily mean responders lack practised coordination, so containment and recovery are delayed or mishandled, extending breach impact. Cost inefficiency is a downstream symptom, not the risk itself. Financial cost would be the correct framing when justifying incident response budget to management, not when identifying the exposure.
- ✗
Increased recovery time after an incident
Why it's wrong here
Untested procedures chiefly mean staff cannot execute response effectively, so containment and eradication slip; recovery time is a downstream symptom, not the primary risk. It is tempting because testing does shorten outages, and would be the answer if the stem asked about downtime metrics.
- ✓
Ineffective response leading to greater damage during an incident
Why this is correct
Untested procedures mean responders lack validated playbooks, so containment, eradication and recovery actions may be improvised or delayed. The stem's two-year gap directly produces prolonged attacker dwell time and greater damage during a live incident.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.