ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is reviewing the software maintenance process for an internally developed legacy system. The auditor observes that changes are implemented directly into the production environment without being first deployed to a staging environment. Which of the following is the MOST significant risk associated with this practice?
- AInefficient use of developer time due to direct production access.
- BLack of proper version control for source code.
- CHigher likelihood of introducing defects into the production system.
- DIncreased difficulty in rolling back problematic changes.
Show answer & explanationAnswer & explanation
Correct answer: C. Higher likelihood of introducing defects into the production system.
Bypassing a staging environment means changes are not fully validated in a production-like setting before deployment. This dramatically increases the risk of introducing errors, performance issues, or unexpected side effects directly into the live system, potentially causing outages or data corruption.
Why the other options are wrong
- A. While developers might spend more time troubleshooting production issues, the primary risk is to system stability and data integrity, not just developer efficiency.
- B. Lack of version control is a serious issue, but it's distinct from the deployment process itself. A system can have version control but still deploy directly to production.
- D. Increased difficulty in rollback is a consequence, but the primary risk is the introduction of defects that necessitate the rollback.
Software Maintenance Controls
Software maintenance controls are procedures and practices designed to ensure that changes to existing software are managed, tested, and implemented securely and effectively.
- Includes change management, testing, and deployment procedures.
- Aims to prevent errors and ensure system stability.
- Often involves separate development, test, and production environments.
Memory trick: No Staging, No Safety, Just Chaos.