CISA Question of the Day: RACI and Accountability

Quiz Yazan Ibrahim

CISA exam practice question — CISA Question of the Day: RACI and Accountability

CISA exam practice question: daily practice for the Certified Information Systems Auditor (CISA) exam — domain: Governance and Management of IT.

Question

During an audit of the IT change management process, you observe a RACI matrix where two different roles are both marked as 'Accountable' for approving production changes. What is the best action for the IS auditor to recommend?

  • A. Accept the arrangement if evidence shows both roles always jointly sign change approvals and no issues have occurred.
  • B. Recommend redefining the RACI so a single role is designated as 'Accountable' and document any delegated responsibilities or approval steps.
  • C. Require immediate suspension of all change approvals until one role is removed from the RACI and the change process is reauthorized.
  • D. Obtain a management representation letter confirming which role is intended to be accountable and rely on that for audit conclusions.
Show the answer and explanation

Correct answer: B. Recommend redefining the RACI so a single role is designated as 'Accountable' and document any delegated responsibilities or approval steps.

The RACI principle of a single 'Accountable' role ensures clear ownership and decision authority; recommending a single accountable role with documented delegation addresses the control deficiency and supports governance. Option A is insufficient because operational evidence of joint sign-off does not remove the ambiguity of responsibility and can mask conflicts. Option C is disproportionate—suspending all changes is disruptive and unnecessary when clarification and documentation can remediate the issue. Option D is weak because a representation letter does not correct the control design weakness or provide assurance that responsibilities are clear and enforceable.

Want more practice?

Prepare for the Certified Information Systems Auditor (CISA) exam with IT Department Audit: Risk, IT Control and Governance Evaluation.