Certified Information Systems Auditor (CISA) — Question 1259

Which of the following is the MAIN risk associated with adding a new system functionality during the development phase without following a project change management process?

Answer options

• A. The new functionality may not meet requirements.
• B. The project may fail to meet the established deadline.
• C. The project may go over budget.
• D. The added functionality has not been documented.

Correct answer: A

Explanation

The correct answer is A because without a proper change management process, the new functionality may not align with the previously established requirements, leading to ineffective implementation. Options B and C, while important, are secondary to the risk of requirements not being met, and option D, although relevant, is more about documentation than the core functionality itself.