Which Incident Management Change Concerns an IS Auditor?

CISA By islever Editorial Last updated Sep 8, 2026

Short answer

B Enabling reporters to assign ticket priority introduces subjective classification risks that compromise standardized incident triage controls.

Question

Which of the following changes intended to improve and streamline an organization's incident management process would be a potential concern to an IS auditor?

Implementing automatic reporting for all open incidents over three months old
Enabling the capability for the individual reporting the incident to assign priority to a ticket Correct Answer
Configuring automated messaging to service lines notifying them of the status of the ticket
Introducing self-service functions for selected low-complexity incident types

Key Takeaways

This question tests the balance between process efficiency and audit controls, with the common trap being the assumption that user empowerment automatically improves incident handling.

Allowing end-users to assign ticket priorities undermines standardized triage controls, making it a primary audit concern despite streamlining efforts. Community consensus confirms that subjective prioritization introduces classification risks that outweigh operational convenience.

Common mistake: Option A is frequently selected because aging incident reports appear risky, but automated visibility actually strengthens accountability rather than creating control gaps.

Expert Analysis

Why the Answer Is Correct

Granting reporters the authority to set ticket priority bypasses established impact-urgency matrices, introducing subjective judgment into critical triage workflows. IS auditors prioritize standardized classification to ensure SLA compliance, accurate resource allocation, and consistent risk assessment across the organization. Without centralized control, high-severity issues may be downgraded while minor requests are escalated unnecessarily.

Why the Other Options Are Wrong

Automated reporting for aging tickets (Option A) increases transparency and helps management identify bottlenecks, which auditors generally favor as a monitoring control. Automated status notifications (Option C) improve communication and tracking without altering decision-making authority. Self-service resolution for low-complexity cases (Option D) reduces analyst workload and is explicitly encouraged in modern ITIL frameworks when properly scoped.

Community Comment Notes

Multiple contributors highlight that reporter-assigned prioritization leads to inconsistent severity mapping and potential SLA violations. One comment correctly notes that subjective judgment compromises efficient incident management, reinforcing the need for trained service desk analysts to handle classification. Another discussion acknowledges aging report risks but correctly identifies them as manageable rather than fundamentally flawed controls.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always evaluate proposed process changes through an audit lens, weighing efficiency gains against control degradation. If a modification removes managerial oversight or introduces subjective decision-making at a critical control point, flag it as a potential audit concern regardless of its operational appeal.

Frequently Asked Questions

Why is automated aging reporting not an audit concern?

It enhances management visibility and accountability for unresolved tickets, which auditors view as a positive monitoring control rather than a risk.

Can self-service incident resolution ever violate audit standards?

Only when applied to complex or security-sensitive cases; limiting it to low-complexity types maintains proper scope and control boundaries.

More CISA FAQ →

Community Votes

67%

33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Swallows 👍 2 Answered B

Allowing individual reporters to determine priority runs the risk of subjective judgment and not prioritizing important incidents appropriately, which can lead to less efficient incident management and resolution.
Swallows 👍 1

B. Enabling the ability for individuals who report incidents to assign priorities to tickets This change is generally expected to have a positive impact as it promotes effective incident management and prioritization. It is expected that reporters will evaluate the importance and urgency of the incident and respond accordingly. Therefore, the change that is of potential concern to IS auditors is "A. Implementing automated reporting for all open incidents older than three months." If this change is not managed properly, there is a risk that it will affect the effectiveness of incident management and the credibility of the organization.
Sibsankar 👍 1

option A does indeed present potential concerns regarding the accuracy and context of reporting for aging incidents. While it aims to improve transparency and accountability, there is a risk of misrepresentation if not implemented carefully.
joehong 👍 1 Answered A

Should be a

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide