ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is evaluating the change management process for a critical production system. The organization recently implemented a new policy requiring emergency changes to undergo a post-implementation review within 48 hours. What is the PRIMARY purpose of this specific timeframe for the review?
- ATo confirm that the change was authorized by appropriate management.
- BTo ensure that the change documentation is updated promptly.
- CTo identify and address any adverse impacts of the change before they become widespread.
- DTo verify that all affected stakeholders are aware of the change.
Show answer & explanationAnswer & explanation
Correct answer: C. To identify and address any adverse impacts of the change before they become widespread.
Emergency changes are implemented rapidly, often bypassing standard testing and review. A prompt post-implementation review (within 48 hours) is crucial to quickly detect any negative side effects or unintended consequences introduced by the emergency change and mitigate them before they cause significant damage or widespread disruption.
Why the other options are wrong
- A. Authorization is typically part of the initial emergency change process, not the primary focus of a post-implementation review's tight timeframe.
- B. While important, updating documentation is a secondary benefit; the primary goal is risk mitigation.
- D. Stakeholder awareness is important for communication but not the core reason for a rapid technical review of the change's impact.
Emergency Change Post-Implementation Review
A rapid assessment conducted shortly after an emergency change to a system to verify its effectiveness, identify any unintended consequences, and ensure stability.
- Mitigates risks from rushed changes.
- Ensures system stability post-change.
- Identifies and addresses adverse impacts quickly.
Memory trick: Emergency change: Review fast, fix faster!