An organization uses an automated continuous integration/continuous deployment (CI/CD) tool to deploy changes to production. Which of the following would be an IS auditor's GREATEST concern in this…

Question

Options

• AReleases are scheduled once per week.
• BPost-implementation reviews are conducted quarterly.
• CTest cases may be inaccurate.
• DFunctional requirements are changed frequently by users.

• A
  10% (3)
• B
  13% (4)
• C
  48% (15)
• D
  29% (9)

Explanation

In a CI/CD pipeline, automated test cases serve as the primary control gate before code reaches production. If those tests are inaccurate - testing the wrong things or missing critical scenarios - defective code will pass every automated check and deploy to production undetected, and automation accelerates that risk at scale. This is a systemic control failure, not a one-time error.

Why the distractors fall short:

• A (weekly releases): A defined release schedule is actually a governance control, not a risk - it shows cadence management, which is normal and acceptable.
• B (quarterly post-implementation reviews): These are detective controls that occur after deployment; an auditor may note the frequency gap, but they don't prevent defective code from reaching production in the first place.
• D (frequent requirement changes): Change management processes exist to handle this; it's a process discipline issue, not a fundamental flaw in the CI/CD control structure itself.

Memory tip: Think of it this way - in CI/CD, the test suite is the auditor. If the auditor is wrong, no one else is checking. Garbage tests = garbage in production, automatically and repeatedly.

No community discussion yet for this question.