ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is reviewing the software maintenance process for an internally developed legacy system. The auditor observes that maintenance requests are often implemented directly into production without prior testing in a separate environment. What is the MOST likely consequence of this practice?
- ANon-compliance with software licensing agreements.
- BDifficulty in attracting and retaining skilled developers.
- CIncreased software development costs over time.
- DReduced system availability due to new defects introduced.
Show answer & explanationAnswer & explanation
Correct answer: D. Reduced system availability due to new defects introduced.
Implementing changes directly into production without testing in a separate environment significantly increases the risk of introducing new defects, regressions, or incompatibilities. These untested changes can lead to system crashes, data corruption, or unexpected behavior, directly resulting in reduced system availability and service disruptions.
Why the other options are wrong
- A. Software licensing is generally independent of the maintenance process itself, unless the maintenance involves third-party components with specific licensing terms.
- B. While poor development practices can affect morale, the most direct operational consequence is system downtime, not solely developer retention.
- C. While poor practices can indirectly increase costs, the most direct and immediate consequence of untested changes is system instability.
Software Maintenance Controls
Processes and procedures designed to ensure that changes to existing software systems are authorized, tested, and implemented in a controlled manner.
- Includes change management, testing, and documentation.
- Critical for system stability and security.
- Applies to bug fixes, enhancements, and patches.
- Should mirror SDLC principles for changes.
Memory trick: Untested Fixes: Fatal Flaws.