CISA - Certified Information Systems Auditor System Development and Implementation Questions and Answers — Questions and Answers
Question 1: An organization is preparing to migrate data from a legacy system to a new ERP platform. Which of the following is the MOST critical control for an IS auditor to verify before the data conversion process begins?
- The new ERP system's user acceptance testing (UAT) has been successfully completed.
- A complete data backup of the legacy system has been performed and validated.
- The data conversion logic has been reviewed and approved by the data owners. (Correct answer)
- End-user training on the new ERP system has been concluded.
Correct answer: The data conversion logic has been reviewed and approved by the data owners.
The accuracy and integrity of the data in the new system depend entirely on the correctness of the conversion logic. Therefore, having the data owners—who are responsible for the data's quality—review and approve the logic is the most critical control to prevent data corruption or misinterpretation during migration. While the other options are important steps in the overall implementation, they do not directly address the integrity of the data conversion itself.
Question 2: During a post-implementation review of a new CRM system, an IS auditor's PRIMARY objective is to determine whether:
- the project was completed within the allocated budget and timeframe.
- all identified bugs and defects from the testing phase have been resolved.
- the system has met the business objectives and delivers the expected benefits. (Correct answer)
- end-users are satisfied with the new system's user interface and performance.
Correct answer: the system has met the business objectives and delivers the expected benefits.
The primary purpose of a post-implementation review is to assess whether the system has achieved its intended business objectives and delivered the value proposed in the business case. While budget, bug resolution, and user satisfaction are important factors to review, the ultimate measure of success is the system's ability to support and improve business processes as originally intended.
Question 3: A software development project is using a traditional Waterfall methodology. An IS auditor would be MOST concerned about the risk of:
- insufficient stakeholder involvement throughout the project.
- the project scope expanding without formal control.
- a lack of detailed documentation for each phase.
- requirements not being fully defined and understood until late in the lifecycle. (Correct answer)
Correct answer: requirements not being fully defined and understood until late in the lifecycle.
A key characteristic and major risk of the Waterfall model is its linear and sequential nature, where each phase must be completed before the next begins. This means that requirements must be fully defined and frozen upfront. Any misunderstandings or changes discovered during the testing or implementation phase are very difficult and costly to address, making this the biggest inherent risk of the methodology.
Question 4: Which of the following testing types is specifically designed to verify that different system components work together as a single, combined unit?
- Unit testing
- Integration testing (Correct answer)
- Stress testing
- User Acceptance Testing (UAT)
Correct answer: Integration testing
Integration testing is performed after unit testing and focuses on exposing faults in the interaction between integrated modules. Its primary purpose is to verify that different components, once combined, function together correctly as a group. Unit testing focuses on individual components in isolation, stress testing evaluates performance under heavy load, and UAT confirms the system meets user needs.
Question 5: An IS auditor is reviewing the change management process for a critical financial application. It is noted that developers are able to promote their own code changes directly into the production environment. This practice represents a failure of which fundamental control principle?
- Principle of least privilege
- Defense in depth
- Segregation of duties (SoD) (Correct answer)
- Security by design
Correct answer: Segregation of duties (SoD)
Segregation of duties (SoD) is a fundamental internal control concept that involves separating tasks and responsibilities among different people to prevent fraud and errors. Allowing a developer to write code and also promote it to production without independent oversight violates SoD, as it creates an opportunity for unauthorized or untested changes to be implemented.
Question 6: When an organization purchases a commercial off-the-shelf (COTS) software package instead of developing it in-house, the PRIMARY shift in risk for the organization is from:
- development and testing risks to vendor management and dependency risks. (Correct answer)
- project management risks to data migration and conversion risks.
- security configuration risks to user training and adoption risks.
- business requirement definition risks to system integration risks.
Correct answer: development and testing risks to vendor management and dependency risks.
When acquiring a COTS solution, the organization offloads the risks associated with software development, coding errors, and internal testing. However, it takes on new risks related to the vendor's financial stability, viability, support quality, and the overall dependency on a third party for maintenance and updates. Therefore, the risk focus shifts significantly from development to vendor management.
CISA - Certified Information Systems Auditor System Development and Implementation Questions and Answers
An organization is preparing to migrate data from a legacy system to a new ERP platform.
Which of the following is the MOST critical control for an IS auditor to verify before the data conversion process begins?