Isaca CISA Questions Answers

The necessary condition for effective risk management in IT governance is that risk evaluation is embedded in management processes. Risk evaluation is the process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable. Risk evaluation should be integrated into the management processes of planning, implementing, monitoring, and reviewing the IT activities and resources. This will ensure that risk management is aligned with the business objectives, strategies, and values, and that risk responses are timely, appropriate, and effective. References:

CISA Review Manual (Digital Version)

CISA Questions, Answers and ExplanationsDatabase

 Requiring documentation that the finding will be addressed within the new system is the best course of action for a follow-up audit. An IS auditor should obtain evidence that the complex security vulnerability of low risk will be resolved in the new system and that there is a reasonable timeline for its implementation. The other options are not appropriate courses of action, as they may be too costly, time-consuming, or impractical for a low-risk finding. References:

CISA Review Manual (Digital Version), Chapter 2, Section 2.5.31

CISA Review Questions, Answersand Explanations Database, Question ID 209

The correct answer is B. Lack of management approval for the configuration control process because configuration management must be formally authorized, governed, and enforced. Without management approval, the process may lack authority, accountability, ownership, and organizational acceptance. This creates a serious risk that configuration changes may be performed inconsistently, without proper control, or outside approved procedures.

ISACA defines configuration management as the control of changes to configuration items over the system life cycle. It also describes configuration management as managing integrity through configuration identification, version control, change control, and audits. This means the configuration process must be formal and controlled, not informal or optional.

Option A is not the greatest concern because vendor-supplied baseline documents can be acceptable as a starting point, provided they are reviewed, customized, formally approved, and aligned with the organization’s requirements. ISACA’s glossary describes a baseline as something formally reviewed and agreed on, serving as the basis for further development and changed only through formal change control procedures.

Option C is not the greatest concern because using commercial software to automate configuration management is generally acceptable. Automation may improve consistency, tracking, and reporting, as long as the tool is properly configured and governed.

Option D is a concern because centralized documentation supports traceability of configuration change approvals. However, the lack of management approval for the overall configuration control process is more fundamental. If the process itself has not been approved, centralized documentation may not be meaningful or consistently enforced.

This question maps mainly to Information Systems Operations and Business Resilience, because ISACA’s CISA Exam Content Outline includes IT Change, Configuration, and Patch Management under Domain 4, and the supporting tasks include evaluating the organization’s change, configuration, release, and patch management programs.