Which SDLC Risk Should Concern a Practitioner Most?
Short answer
A Segregation of duties controls are overridden during user testing phases
Question
Key Takeaways
Tests prioritization of control failures in SDLC phases, with the common trap being mistaking process deviations for higher risks than fundamental control overrides like SoD.
This CRISC question tests your ability to identify critical control weaknesses within the System Development Life Cycle (SDLC). The community overwhelmingly agrees that overriding segregation of duties (SoD) poses the highest risk due to potential fraud, errors, and compromised system integrity.
Common mistake: Option B is frequently chosen incorrectly because practitioners often assume exclusive IT involvement invalidates testing; however, while suboptimal, it does not carry the same immediate fraud and compliance risk as overriding segregation of duties.
Expert Analysis
Why the Answer Is Correct
Segregation of duties (SoD) is a foundational internal control designed to prevent fraud, errors, and unauthorized activities by ensuring no single individual controls an entire process. Overriding SoD during any SDLC phase, especially user testing, removes critical checks and balances, directly exposing the organization to financial loss, data breaches, and compliance violations. For a CRISC risk practitioner, preserving control integrity always outweighs procedural inefficiencies, making this the most severe concern.
Why the Other Options Are Wrong
Option B describes incomplete testing validation, which is a quality issue but lacks the direct fraud and control breakdown associated with SoD overrides. Option C is actually a best practice, as data anonymization protects sensitive information throughout testing cycles. Option D reflects standard SDLC methodology where user acceptance testing logically concludes the development cycle before production deployment. None of these alternatives present an immediate, high-impact control failure comparable to bypassing SoD.
Community Comment Notes
Multiple highly-rated comments emphasize that SoD overrides fundamentally undermine auditability and system reliability, introducing unchecked opportunities for malicious activity or accidental errors. Contributors note that while IT-led testing or phased approaches may require remediation, they do not compromise the core governance framework like SoD bypasses do. The consensus reinforces that risk practitioners must prioritize control environment weaknesses over operational workflow preferences.
Official Reference
https://www.isaca.org/resources/isaca-journal/past-issues/2019/volume-5/sdlc-risk-management
This link opens the official vendor documentation in a new tab.
Exam Strategy
When evaluating SDLC scenarios on the CRISC exam, always prioritize fundamental control weaknesses over process inefficiencies or workflow preferences. Use the risk-based approach by asking which option creates the highest likelihood of fraud, data breach, or compliance failure, as ISACA consistently rewards answers that protect the control environment first.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Baddest 👍 2A. Segregation of duties controls are overridden during user testing phases Segregation of duties controls are critical for preventing fraud and errors by ensuring that no single individual has the ability to execute a critical process from beginning to end without oversight. Overriding these controls during user testing phases could potentially lead to unauthorized or inappropriate actions being taken, increasing the risk of fraud, errors, or data breaches. Therefore, a risk practitioner would be particularly concerned if segregation of duties controls were compromised during any phase of the SDLC, as it could introduce significant risks to the development process and the resulting system
-
d9iceguy 👍 1 Answered AOverriding segregation of duties (SoD) controls poses the greatest risk in the SDLC because it: Introduces the potential for unauthorized changes, fraud, errors, or malicious activities. Undermines fundamental controls meant to ensure the integrity and reliability of the system. Can significantly compromise security, auditability, and compliance throughout the development lifecycle. Why not the other options? B. Testing by IT support users without end-user input: A concern for functionality or usability, but less severe than overriding critical security controls. C. Data anonymization used during end-user testing: Actually reduces risk by protecting sensitive data. D. User testing as the final phase: A standard approach in many SDLC methodologies; not inherently a significant risk.
-
lferolm 👍 1 Answered ASegregation of duties controls are overridden during user testing phases: This is the most concerning issue for a risk practitioner because segregation of duties (SoD) is a critical internal control designed to prevent conflicts of interest and reduce the risk of errors and fraud. Overriding these controls during any phase of the SDLC, including user testing, can lead to significant risks such as unauthorized access, manipulation of data, and lack of accountability. This concern directly impacts the integrity, security, and reliability of the system being developed.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CRISC Questions
Access 332 questions with complete answers and detailed explanations.
View Full CRISC Practice Test →