CISA Domain 3

The phases and deliverables of a system development life cycle project should be determined:

• During the initial planning stages of the project.

• After early planning has been completed but before work has begun

• Throughout the work stages, based on risk and exposures

• Only after all risk and exposures have been identified and the IS auditor has recommended appropriate controls

During the audit of an acquired software package, an IS auditor finds that the software purchase was based on information obtained through the Internet, rather than from responses to a request for proposal. The IS auditor should first:

• Test the software for compatibility with existing hardware

• Perform a gap analysis

• Review the licensing policy

• Ensure that the procedure had been approved.

Ideally, stress testing should be carried out in a

• Test environment using test data

• Production environment using live workloads

• Test environment using live workloads

• Production environment using test data

Change control for business application systems being developed using prototyping could be complicated by the:

• Iterative nature of prototyping.

• Rapid pace of modifications in requirements and design

• Emphasis on reports and screens

• Lack of integrated tools

The best time for an IS auditor to assess the control specifications of a new application software package which is being considered for acquisition is during:

• The internal lab testing phase

• Testing and prior to user acceptance

• The requirements gathering process

• The implementation phase

Which of the following helps an information systems (IS) auditor evaluate the quality of new software that is developed and implemented?

• Reporting of the mean time between failures over time

• Overall mean time to repair failures

• First report of the mean time between failures

• Overall response time to correct failures

Which of the following is the BEST approach to ensure that sufficient test coverage will be achieved for a project with a strict end date and a fixed time to perform testing?

• 1. Requirements should be tested in terms of importance and frequency of use.

• Test coverage should be restricted to functional requirements

• Automated tests should be performed using scripting

• The number of required test runs should be reduced by retesting only defect fixes

An organization is replacing a payroll program that it developed in-house, with the relevant subsystem of a commercial enterprise resource planning (ERP) system. Which of the following represents the HIGHEST potential risk?

• Undocumented approval of some project changes

• Faulty migration of historical data from the old system to the new system

• Incomplete testing of the standard functionality of the ERP subsystem

• Duplication of existing payroll permissions on the new ERP subsystem

Due to a reorganization, a business application system will be extended to other departments. Which of the following should be of the GREATEST concern for an information systems (IS) auditor?

• Process owners have not been identified

• The billing cost allocation method has not been determined

• Multiple application owners exist.

• A training program does not exist.

The waterfall life cycle model of software development is MOST appropriately used when:

• requirements are well understood and are expected to remain stable, like the business environment in which the system will operate.

• requirements are well understood and the project is subject to time pressures.

• the project intends to apply an object-oriented design and programming approach.

• the project will involve the use of new technology.