ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
During a post-implementation review of a new customer relationship management (CRM) system, an IS auditor identifies that user acceptance testing (UAT) sign-offs were obtained from department managers, but not from actual end-users. Which of the following is the MOST significant risk associated with this finding?
- AThe system may not comply with regulatory requirements.
- BThe system may not adequately support business processes.
- CThe system's performance may not meet service level agreements.
- DThe project budget may have been exceeded due to rework.
Show answer & explanationAnswer & explanation
Correct answer: B. The system may not adequately support business processes.
UAT is designed to ensure the system meets the needs of its end-users. If end-users are not involved in UAT sign-off, there is a high risk that the system's functionality will not align with their daily operational requirements, leading to inefficiencies or failure to achieve business objectives.
Why the other options are wrong
- A. While possible, UAT primarily focuses on functional user requirements, not necessarily regulatory compliance, which is typically addressed earlier in the SDLC.
- C. Performance testing usually addresses SLAs, not UAT, which focuses on functional acceptance.
- D. Budget overruns due to rework are a consequence of inadequate UAT, but the most significant risk is the system's inability to support the business, which causes the rework.
User Acceptance Testing (UAT)
User Acceptance Testing (UAT) is the final stage of testing where actual users verify that the system meets business requirements and is suitable for deployment.
- Performed by end-users or client representatives.
- Focuses on validating business requirements.
- Crucial for ensuring system usability and functionality.
Memory trick: Users Accept, Business Benefits.