CISA System Development and Implementation 2 — Questions and Answers
Question 1: During a post-implementation review, an IS auditor finds that user acceptance testing (UAT) was bypassed due to project deadline pressure. What is the PRIMARY risk?
- Budget overruns in future phases
- Undiscovered defects may reach production (Correct answer)
- Development team morale decreases
- Project documentation becomes incomplete
Correct answer: Undiscovered defects may reach production
Skipping UAT means business requirements may not be met and defects unknown to users can propagate into the live environment.
Question 2: Which SDLC phase is MOST concerned with translating business requirements into technical specifications?
- Feasibility study
- Systems design (Correct answer)
- Programming and testing
- Implementation
Correct answer: Systems design
The systems design phase converts logical business requirements into detailed technical blueprints for developers.
Question 3: An IS auditor is reviewing a change management process. Which control BEST ensures only authorized changes reach production?
- Automated code compilation logs
- Segregation of duties between developers and production migration staff (Correct answer)
- Mandatory code comments in all programs
- Weekly status meetings with the project manager
Correct answer: Segregation of duties between developers and production migration staff
Segregation of duties prevents developers from promoting their own code, ensuring an independent review before production migration.
Question 4: What does a Gantt chart PRIMARILY help an IS auditor assess during a systems development review?
- Code quality and defect density
- Project schedule and milestone adherence (Correct answer)
- Budget variance and cost overruns
- Vendor contract compliance
Correct answer: Project schedule and milestone adherence
A Gantt chart visually represents task timelines and milestones, allowing auditors to assess schedule progress and delays.
Question 5: During testing, a developer discovers a critical defect but the project manager instructs the team to proceed to production anyway. The IS auditor's BEST response is to:
- Immediately shut down the project
- Document the risk and escalate to senior management (Correct answer)
- Accept the decision since it is management's prerogative
- Rewrite the affected module independently
Correct answer: Document the risk and escalate to senior management
The auditor's role is to document findings and escalate unresolved risks through proper governance channels, not to override management decisions unilaterally.
Question 6: Which testing type validates that a new system does not adversely affect existing integrated systems?
- Unit testing
- Regression testing (Correct answer)
- Stress testing
- Parallel testing
Correct answer: Regression testing
Regression testing re-runs prior test cases to confirm that new changes have not broken existing functionality in interconnected systems.
Question 7: An organization migrates to a new ERP system using a phased approach. The PRIMARY advantage of this strategy over a big-bang cutover is:
- Lower total project cost
- Reduced disruption and ability to isolate issues by module (Correct answer)
- Faster overall implementation timeline
- Elimination of data conversion requirements
Correct answer: Reduced disruption and ability to isolate issues by module
Phased implementation reduces risk by limiting scope at each stage, making it easier to identify and resolve problems without impacting the entire organization.
CISA System Development and Implementation 2
During a post-implementation review, an IS auditor finds that user acceptance testing (UAT) was bypassed due to project deadline pressure.
What is the PRIMARY risk?