CISA - Certified Information Systems Auditor System Development and Implementation Questions and Answers

Question 1

An organization is preparing to migrate data from a legacy system to a new ERP platform. Which of the following is the MOST critical control for an IS auditor to verify before the data conversion process begins?

Accepted Answer

The data conversion logic has been reviewed and approved by the data owners.

Answer

The accuracy and integrity of the data in the new system depend entirely on the correctness of the conversion logic. Therefore, having the data owners—who are responsible for the data's quality—review and approve the logic is the most critical control to prevent data corruption or misinterpretation during migration. While the other options are important steps in the overall implementation, they do not directly address the integrity of the data conversion itself.

Question 2

During a post-implementation review of a new CRM system, an IS auditor's PRIMARY objective is to determine whether:

Accepted Answer

the system has met the business objectives and delivers the expected benefits.

Answer

The primary purpose of a post-implementation review is to assess whether the system has achieved its intended business objectives and delivered the value proposed in the business case. While budget, bug resolution, and user satisfaction are important factors to review, the ultimate measure of success is the system's ability to support and improve business processes as originally intended.

Question 3

A software development project is using a traditional Waterfall methodology. An IS auditor would be MOST concerned about the risk of:

Accepted Answer

requirements not being fully defined and understood until late in the lifecycle.

Answer

A key characteristic and major risk of the Waterfall model is its linear and sequential nature, where each phase must be completed before the next begins. This means that requirements must be fully defined and frozen upfront. Any misunderstandings or changes discovered during the testing or implementation phase are very difficult and costly to address, making this the biggest inherent risk of the methodology.

Question 4

Which of the following testing types is specifically designed to verify that different system components work together as a single, combined unit?

Accepted Answer

Integration testing

Answer

Integration testing is performed after unit testing and focuses on exposing faults in the interaction between integrated modules. Its primary purpose is to verify that different components, once combined, function together correctly as a group. Unit testing focuses on individual components in isolation, stress testing evaluates performance under heavy load, and UAT confirms the system meets user needs.

Question 5

An IS auditor is reviewing the change management process for a critical financial application. It is noted that developers are able to promote their own code changes directly into the production environment. This practice represents a failure of which fundamental control principle?

Accepted Answer

Segregation of duties (SoD)

Answer

Segregation of duties (SoD) is a fundamental internal control concept that involves separating tasks and responsibilities among different people to prevent fraud and errors. Allowing a developer to write code and also promote it to production without independent oversight violates SoD, as it creates an opportunity for unauthorized or untested changes to be implemented.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor System Development and Implementation Questions and Answers