ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationEasy
A project manager is overseeing the development of a complex financial reporting system. During the testing phase, several critical defects are identified. The project sponsor demands an expedited release. What is the IS auditor's PRIMARY recommendation regarding this demand?
- ASuggest a phased rollout strategy to mitigate risk while meeting the sponsor's demand.
- BPropose an independent third-party review of the defects to determine their true impact.
- CRecommend implementing a temporary workaround for the critical defects to meet the deadline.
- DAdvise against expedited release until all critical defects are resolved and retested.
Show answer & explanationAnswer & explanation
Correct answer: D. Advise against expedited release until all critical defects are resolved and retested.
Releasing a system with known critical defects can lead to significant operational disruptions, financial losses, and reputational damage. The IS auditor's primary role is to protect organizational assets and ensure system integrity.
Why the other options are wrong
- A. A phased rollout is a risk mitigation strategy but does not address the fundamental issue of critical defects in the core system.
- B. While an independent review can be valuable, it delays resolution and does not change the fact that critical defects exist, making immediate resolution the priority.
- C. Workarounds introduce additional complexity and potential for new errors, not a solution for critical defects.
Critical Defect Management
The process of identifying, prioritizing, and resolving software flaws that severely impact system functionality, security, or data integrity before system release.
- Prevents operational disruptions.
- Protects data integrity.
- Safeguards organizational reputation.
Memory trick: Don't sail a leaky ship, fix it first!