CISA System Development and Implementation 2

Question 1

During a post-implementation review, an IS auditor finds that user acceptance testing (UAT) was bypassed due to project deadline pressure. What is the PRIMARY risk?

Accepted Answer

Undiscovered defects may reach production

Answer

Skipping UAT means business requirements may not be met and defects unknown to users can propagate into the live environment.

Question 2

Which SDLC phase is MOST concerned with translating business requirements into technical specifications?

Accepted Answer

Systems design

Answer

The systems design phase converts logical business requirements into detailed technical blueprints for developers.

Question 3

An IS auditor is reviewing a change management process. Which control BEST ensures only authorized changes reach production?

Accepted Answer

Segregation of duties between developers and production migration staff

Answer

Segregation of duties prevents developers from promoting their own code, ensuring an independent review before production migration.

Question 4

What does a Gantt chart PRIMARILY help an IS auditor assess during a systems development review?

Accepted Answer

Project schedule and milestone adherence

Answer

A Gantt chart visually represents task timelines and milestones, allowing auditors to assess schedule progress and delays.

Question 5

During testing, a developer discovers a critical defect but the project manager instructs the team to proceed to production anyway. The IS auditor's BEST response is to:

Accepted Answer

Document the risk and escalate to senior management

Answer

The auditor's role is to document findings and escalate unresolved risks through proper governance channels, not to override management decisions unilaterally.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA System Development and Implementation 2