An IS auditor is evaluating the readiness of a new critical online banking system for implementation. The user acceptance testing (UAT) phase has concluded, but several high-severity defects remain unresolved, albeit with workarounds in place. The project manager proposes to go live as scheduled, citing business pressure. What should be the IS auditor's PRIMARY recommendation?
- AProceed with the go-live, but implement enhanced post-implementation monitoring.
- BConduct a cost-benefit analysis of delaying the project versus the risks of going live with defects.
- CDelay the go-live until all high-severity defects are fully resolved and retested.
- DAccept the workarounds, but require formal sign-off from all affected business units.
Show answer & explanationAnswer & explanation
Correct answer: C. Delay the go-live until all high-severity defects are fully resolved and retested.
High-severity defects, even with workarounds, pose significant risks to system stability, data integrity, security, and customer trust, especially in a critical online banking system. Delaying go-live until these are resolved and retested is the most prudent step to protect the organization from potentially catastrophic operational and reputational damage. Workarounds are temporary fixes and do not eliminate the underlying defect or its inherent risks.
Why the other options are wrong
- A. Enhanced monitoring might detect issues, but it doesn't prevent them from occurring due to unresolved high-severity defects.
- B. While a cost-benefit analysis is good practice, for *high-severity* defects in a *critical* system, the immediate priority is risk mitigation, which generally outweighs the costs of delay.
- D. Formal sign-off acknowledges the risk but does not mitigate the technical and operational impact of high-severity defects.
Go-Live Readiness Assessment
The final evaluation before deploying a new system to production, assessing its preparedness across technical, operational, security, and business aspects.
- Includes review of testing results, defect resolution, and training.
- Critical for high-risk systems.
- Unresolved high-severity defects typically warrant delay.
- Focuses on minimizing post-implementation risks.
Memory trick: Critical Go-Live: Defects Delay.