ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceHard
An IS auditor is reviewing an organization's information systems maintenance practices. The organization uses a 'break/fix' model for critical applications, where maintenance is performed only when a system fails or experiences a significant issue. What is the MOST significant long-term consequence of this approach?
- ALack of compliance with software licensing agreements.
- BDifficulty in tracking maintenance costs and budgeting.
- CIncreased risk of vendor lock-in due to specialized repair knowledge.
- DReduced system availability and increased operational instability.
Show answer & explanationAnswer & explanation
Correct answer: D. Reduced system availability and increased operational instability.
A 'break/fix' model means that potential issues are not addressed proactively. Over time, this leads to an accumulation of technical debt, unpatched vulnerabilities, and hardware degradation, resulting in more frequent, severe, and unpredictable system failures, thereby reducing overall availability and stability.
Why the other options are wrong
- A. License compliance relates to usage rights, not the timing or method of system maintenance.
- B. Budgeting can be difficult, but the direct impact on system reliability is more critical.
- C. Vendor lock-in is a separate issue related to technology choices, not directly caused by the break/fix maintenance model.
Reactive Maintenance (Break/Fix)
Maintenance performed in response to a system failure or defect, rather than as part of a scheduled or preventive plan.
- Often leads to unplanned downtime and high emergency costs.
- Can result in shorter asset lifespans.
- Contrasts with proactive maintenance strategies like preventive or predictive maintenance.
Memory trick: Waiting for a break to fix is like waiting for your car to die on the highway before getting an oil change.