IT Acquisition, Development, and Implementation Flashcards
7 cards from real ISACA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 IT Acquisition, Development, and Implementation flashcards as text
When auditing application controls, which control type BEST ensures that all data entered into a system has been processed completely?
Answer: Batch totals
Batch totals compare the sum of input records to a predetermined control total, ensuring all records in the batch were fully processed.
During data conversion from a legacy to a new system, which procedure is MOST important for ensuring data integrity?
Answer: Performing parallel processing and reconciling results between systems
Parallel processing runs both systems simultaneously and reconciles outputs to verify the new system produces accurate results consistent with the legacy system.
User acceptance testing (UAT) is PRIMARILY performed by which group?
Answer: End users and business stakeholders
UAT is performed by end users and business stakeholders to confirm the system meets their operational requirements before go-live approval.
Which configuration management practice BEST supports an audit trail for system changes?
Answer: Maintaining a configuration management database (CMDB)
A CMDB tracks configuration items, their attributes, and their change history, providing a comprehensive record that supports audit trails and impact analysis.
In an Agile development methodology, what is the PRIMARY audit concern compared to a traditional waterfall approach?
Answer: Documentation and formal change control may be less rigorous
Agile's iterative and flexible nature may result in less formal documentation and change control, creating audit challenges around completeness and traceability.
When auditing an outsourced software development arrangement, an IS auditor should PRIMARILY review which documentation?
Answer: Contract terms, SLAs, and right-to-audit clauses
Contract terms, SLAs, and right-to-audit clauses define vendor obligations and provide the legal basis for the auditor to assess vendor performance and controls.
An effective patch management process should ENSURE which of the following practices?
Answer: Patches are tested in a non-production environment before deployment
Testing patches in a non-production environment before deployment ensures that untested updates do not disrupt or destabilize production systems.