ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is reviewing the system acquisition process for a new enterprise resource planning (ERP) system. The project team has identified several potential vendors and is now evaluating their proposals. Which of the following is the MOST critical control for the IS auditor to verify at this stage?
- AVerification of vendor's adherence to industry security standards and certifications.
- BEstablishment of clear and measurable evaluation criteria aligned with business requirements.
- CReview of the proposed system architecture for scalability and integration capabilities.
- DConfirmation of vendor financial stability and market reputation.
Show answer & explanationAnswer & explanation
Correct answer: B. Establishment of clear and measurable evaluation criteria aligned with business requirements.
Establishing clear and measurable evaluation criteria ensures that vendor proposals are assessed objectively against the organization's specific business needs, leading to the selection of the most suitable system. Without this, other evaluations may be subjective or misaligned.
Why the other options are wrong
- A. Security standards are critical, but they are one of many criteria that need to be clearly defined and measured during the evaluation.
- C. System architecture is important, but it's evaluated against criteria that must first be defined based on business needs.
- D. While important, financial stability and reputation are secondary to ensuring the proposed system meets functional and non-functional requirements.
Vendor Proposal Evaluation Criteria
Clear, measurable standards used to objectively assess vendor proposals against an organization's specific business and technical requirements.
- Ensures objective comparison of proposals.
- Directly links vendor offerings to business needs.
- Forms the basis for informed decision-making.
Memory trick: Criteria are the compass guiding the acquisition ship.