Auditor Next Step After Release-Related Production Incident

CISA By islever Editorial Last updated

Short answer

D Evaluate the change management process to verify that testing, approvals, and deployment controls prevented the release-related defect from reaching production.

Question

An IS auditor noted a recent production incident in which a teller transaction system incorrectly charged fees to customers due to a defect from a recent release. Which of the following should be the auditor's NEXT step?
  1. Evaluate developer training.
  2. Evaluate secure code practices.
  3. Evaluate the incident management process.
  4. Evaluate the change management process. Correct Answer

Key Takeaways

Tests the auditor’s ability to trace a production defect back to its lifecycle stage, with the common trap being an immediate focus on incident response instead of the underlying release control failure.

This CISA question tests whether auditors prioritize incident response or change control after a release-caused defect. While community votes split evenly, expert analysis confirms evaluating the change management process is the correct next step to address the root cause.

Common mistake: Option C is frequently chosen because auditors instinctively look at incident handling first, but it misses the explicit clue that the defect originated from a recent release, making change management the higher-priority audit area.

Expert Analysis

Why the Answer Is Correct

The correct choice is D because the question explicitly states the defect stemmed from a recent release. In CISA methodology, any production error linked to a deployment must trigger a review of the change management process, which governs testing, approval, and rollout controls. Evaluating this process determines whether safeguards like user acceptance testing or rollback procedures failed.

Why the Other Options Are Wrong

Option A and B focus on developer capabilities rather than organizational controls, which are outside the scope of an immediate post-incident audit step. Option C addresses how the team responded to the outage, but does not investigate why the defective code passed through deployment gates. Auditors prioritize prevention and control validation over reactive measures when the root cause is clearly identified.

Community Comment Notes

Several top-voted comments correctly identify D as the answer, noting that insufficient testing during the release phase points directly to change management gaps (Comment 2, 3, 4). Others argue for C based on standard incident response protocols, highlighting why candidates often split their votes. The consensus among experienced IS auditors aligns with tracing defects to their source control point before assessing response effectiveness.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a CISA question mentions a defect tied to a 'recent release,' 'deployment,' or 'patch,' immediately map it to change management controls. Prioritize reviewing testing, approvals, and rollback procedures in your audit steps, as ISACA consistently tests control ownership over lifecycle stages rather than generic response workflows.

Frequently Asked Questions

Why not evaluate incident management first?

Incident management handles response and recovery, but the question explicitly ties the defect to a recent release. Auditors prioritize tracing the root cause to change controls for prevention.

Does change management include software testing?

Yes. CISA classifies requirement analysis, code review, user acceptance testing, and deployment approvals under the change management lifecycle, making it the correct audit focus here.

More CISA FAQ →

Community Votes

C
50%
D
50%

50% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. a84n 👍 3 Answered C
    Answer: C evaluating the incident management process, is typically the more immediate and pressing concern following a production incident.
  2. PurpleParrot 👍 2 Answered D
    The defect originated from a recent release, suggesting that the issue is likely related to the change management process. Evaluating change management will help determine whether proper procedures were followed during the release and if the defect was introduced due to issues in planning, testing, or implementing the change.
  3. Eruza89 👍 2
    D for me. The auditor should review the change mgmt process to determine how this release was approved. It is likely that testing procedures were insufficient
  4. Ehiso 👍 1 Answered D
    Since the defect in the teller transaction system was caused by a recent release, it is likely tied to a change made in the system. The auditor should assess the change management process to determine if proper procedures were followed, such as: Were the changes thoroughly tested before being deployed to production? Did the change management process include adequate reviews, approvals, and documentation? Were the necessary rollback or mitigation procedures in place in case of an issue? By evaluating the change management process, the auditor can determine if weaknesses in th
  5. Sibsankar 👍 2
    C is perfect

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Greatest Fraud Risk: Mandatory Leave vs Access Reviews

S-grade

Environmental Detector Placement Risks in Data Centers

S-grade

Next Step When Periodic Access Reviews Are Missing | CISA

S-grade

Best Backup Scheme for Rapid Data Restoration?

S-grade

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide