Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Systems Auditor · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
C is correct. Once management approves exceptions, they’re no longer violations - they’re accepted risks. That means the real concern isn’t noncompliance, it’s higher operational risk from too many control gaps.
I vote C
While Option C is also a valid concern, as exceptions may indeed elevate the level of operational risk by deviating from standard procedures or controls, noncompliance poses a more significant and overarching risk to the organization's compliance status and overall governance framework.