ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationHard
An IS auditor is reviewing controls over system acquisition for a new enterprise resource planning (ERP) system. The project team has developed a detailed Request for Proposal (RFP) and received multiple vendor responses. Which of the following criteria should the IS auditor recommend as the MOST important to evaluate vendor proposals against for a complex ERP system?
- AThe proposed implementation timeline and project plan.
- BThe vendor's reputation and market share.
- CThe vendor's ability to meet critical business requirements.
- DThe lowest total cost of ownership (TCO).
Show answer & explanationAnswer & explanation
Correct answer: C. The vendor's ability to meet critical business requirements.
For a complex system like ERP, the vendor's ability to meet critical business requirements is paramount. Without this, even a low-cost, reputable vendor with a fast timeline will deliver a system that fails to support core business operations, leading to significant financial and operational losses.
Why the other options are wrong
- A. Implementation timeline is important for project planning, but secondary to ensuring the delivered system actually works for the business.
- B. Reputation is a good indicator, but it doesn't guarantee a specific solution will fit the organization's unique needs.
- D. While TCO is important, a low-cost system that doesn't meet requirements is a poor investment.
Vendor Proposal Evaluation Criteria
Vendor proposal evaluation criteria are the standards used to assess and compare bids from potential suppliers for system acquisition, ensuring the chosen solution best meets organizational needs.
- Should be defined before proposals are received.
- Includes functional, technical, financial, and support aspects.
- Critical business requirements are usually weighted highest.
Memory trick: Requirements Rule, Everything Else Follows.