An IS auditor is reviewing the acquisition process for a new enterprise resource planning (ERP) system. The auditor notes that the organization's legal department was only involved at the final contract signing stage. What is the MOST significant risk associated with this approach?
- AThe system may not integrate well with existing IT infrastructure.
- BThe project budget may be exceeded due to scope creep.
- CEnd-users may resist adoption of the new system.
- DThe organization may incur unforeseen legal liabilities or unfavorable terms.
Show answer & explanationAnswer & explanation
Correct answer: D. The organization may incur unforeseen legal liabilities or unfavorable terms.
Involving the legal department only at the contract signing stage means that critical legal implications, terms, conditions, intellectual property rights, data privacy clauses, and potential liabilities may not have been properly reviewed and negotiated during the earlier stages of vendor selection and contract drafting. This significantly increases the risk of the organization being bound by unfavorable terms or incurring unforeseen legal liabilities.
Why the other options are wrong
- A. System integration is an IT/technical concern, not primarily a legal one, although legal terms might affect vendor responsibilities.
- B. Scope creep is a project management risk, not directly addressed by legal involvement, although legal terms can help define scope.
- C. User resistance is a change management issue, not directly related to the legal department's involvement in the acquisition process.
Legal Review in System Acquisition
The process of involving legal counsel throughout the system acquisition lifecycle, particularly during vendor selection, contract negotiation, and due diligence, to identify and mitigate legal risks.
- Ensures compliance with laws and regulations.
- Protects intellectual property and data rights.
- Clarifies responsibilities, warranties, and liabilities.
- Aids in negotiating favorable contract terms.
Memory trick: Acquisition Risks: Legal Late, Liabilities Loom.