問題文
A 40-person insurance company has one administrator who makes changes directly in production. There is no version control and no sandbox in regular use. A consultant proposes an architecture review board, a change advisory board, a four-environment promotion path, and mandatory peer review starting next week. What is the main risk of this recommendation?
選択肢
- The controls are appropriate, and the only risk is that the license cost of the additional environments will exceed the annual budget for the platform, which is a purchasing question rather than a governance question and can be resolved by the sponsor later.
- The risk is that peer review requires a second administrator, and hiring takes longer than a week, so the review board should be created first and peer review added after the second hire arrives.
- There is no risk, because more governance is always safer.
- The controls exceed what the team can operate, so they will be bypassed and the organization will end up with the same practices plus a paper process nobody follows.