The IS auditor's independence would be most likely impaired if they implemented a specific control during the development of an application system. This is because the IS auditor would be auditing their own work, which creates a self-review threat that could compromise their objectivity and impartiality. The IS auditor should avoid participating in any operational or management activities that could affect their ability to perform an unbiased audit. The other options do not pose a significant threat to the IS auditor's independence, as long as they follow the ethical standards and guidelines of the profession.

To ensure that theBCP aligns with business strategy, aBusiness Impact Analysis (BIA)is the most valuable resource.
Option A (Incorrect):DRP testing resultsshow how wellsystems recover, but they do notestablish strategic alignmentwith business priorities.
Option B (Correct):ABIA identifies critical processes, financial impact, and business priorities, ensuring that theBCP is alignedwith strategic goals.
Option C (Incorrect):Thecorporate risk management policyis broader and does not focus onbusiness continuity priorities.
Option D (Incorrect):KPIs measure performance, but they do notdefine business continuity needs.
Reference:ISACA CISA Review Manual -Domain 4: Information Systems Operations and Business Resilience- CoversBCP, BIA, and business continuity alignment.

Change control is the process of managing and documenting changes to an information system or its components. Change control aims to ensure that changes are authorized, tested, approved, implemented, and reviewed in a controlled and consistent manner. Change control is an essential part of ensuring the security, reliability, and quality of an information system.
One of the key elements of change control is testing and approval from quality assurance (QA). QA is the function that verifies that the changes meet the requirements and specifications, comply with the standards and policies, and do not introduce any errors or vulnerabilities. QA testing and approval provide assurance that the changes are fit for purpose, function as expected, and do not compromise the security or performance of the system.
An organization that has recently moved to an agile model for deploying custom code to its in-house accounting software system should still follow change control procedures, including QA testing and approval.
Agile development methods emphasize flexibility, speed, and collaboration, but they do not eliminate the need for quality and security checks. In fact, agile methods can facilitate change control by enabling frequent and iterative testing and feedback throughout the development cycle.
However, if change control does not include testing and approval from QA, this poses a significant security concern for the organization. Without QA testing and approval, the changes may not be properly validated, verified, or evaluated before being deployed to production. This could result in introducing bugs, defects, or vulnerabilities that could affect the functionality, availability, integrity, or confidentiality of the accounting software system. For example, a change could cause data corruption, performance degradation, unauthorized access, or data leakage. These risks could have serious consequences for the organization's financial operations, compliance obligations, reputation, or legal liabilities.
Therefore, change control that does not include testing and approval from QA is the most significant security concern to address when reviewing the procedures in place for production code deployment in an agile model.
References:
Change Control - ISACA
Quality Assurance - ISACA
Agile Development - ISACA
10 Agile Software Development Security Concerns You Need to Know

The correct answer is A. Periodic database maintenance.
A DBMS requires regular maintenance to keep performance at an optimal level. Periodic database maintenance may include rebuilding or reorganizing indexes, updating statistics, checking database integrity, archiving or purging obsolete data, monitoring storage utilization, reviewing query performance, and tuning database parameters. These activities help prevent performance degradation as data volumes grow and transaction patterns change.
ISACA defines a DBMS as software that controls the organization, storage, and retrieval of data in a database.
ISACA also notes that the database administrator's responsibilities include database design, definition, and maintenance. This supports the point that ongoing maintenance is central to effective database operation.
Option B is not the best answer because data consistency control protects the correctness and integrity of data, but it does not directly keep the DBMS at maximum performance.
Option C is not the best answer because database logging supports recovery, troubleshooting, accountability, and auditability, but logging can also add overhead and is not primarily a performance optimization activity.
Option D is not the best answer because data model normalization improves data structure and reduces redundancy during database design. However, once the database is in operation, periodic maintenance is more directly effective for sustaining DBMS performance.
This question maps to Information Systems Operations and Business Resilience because the CISA Exam Content Outline includes Database Management and evaluation of IT operations and maintenance practices under Domain 4.
References: ISACA CISA Exam Content Outline, Domain 4; ISACA Interactive Glossary, "Database management system" and "Database administrator."

The sampling method in which the entire sample is considered to be irregular if a single error is found is discovery sampling. Discovery sampling is a type of statistical sampling that is used to test for the existence of at least one occurrence of a specific characteristic or condition in a population. Discovery sampling is often used when the auditor expects the characteristic or condition to be very rare or nonexistent, and when any occurrence would have a significant impact on the audit objective. For example, discovery sampling can be used to test for fraud, noncompliance, or material misstatement.
Discovery sampling works by setting a very low tolerable error rate (the maximum rate of occurrence of the characteristic or condition that the auditor is willing to accept) and a high confidence level (the degree of assurance that the auditor wants to obtain). The auditor then selects a sample from the population using a random or systematic method, and examines each item in the sample for the presence or absence of the characteristic or condition. If no error is found in the sample, the auditor can conclude with a high level of confidence that the characteristic or condition does not exist or is very rare in the population. However, if one or more errors are found in the sample, the auditor cannot draw any conclusion about the population and must either expand the sample size or perform alternative procedures.
Discovery sampling differs from other sampling methods in that it does not allow for any errors in the sample.
Other sampling methods, such as variable sampling, stop-or-go sampling, or judgmental sampling, can tolerate some errors in the sample and use them to estimate the error rate or amount in the population.
However, discovery sampling is designed to test for zero-tolerance situations, where any error would be unacceptable or material. Therefore, discovery sampling considers the entire sample to be irregular if a single error is found.
References:
Audit Sampling - Overview, Purpose, Importance, and Types1
Audit Sampling - What Is It, Methods, Example, Advantage, Reason2
ISA 530: Audit sampling | ICAEW3
Audit Sampling - AICPA4