ExamGecko
Question list
Search
Search

Related questions











Question 291 - CISA discussion

Report
Export

A third-party consultant is managing the replacement of an accounting system. Which of the following should be the IS auditor's GREATEST concern?

A.
Data migration is not part of the contracted activities.
Answers
A.
Data migration is not part of the contracted activities.
B.
The replacement is occurring near year-end reporting
Answers
B.
The replacement is occurring near year-end reporting
C.
The user department will manage access rights.
Answers
C.
The user department will manage access rights.
D.
Testing was performed by the third-party consultant
Answers
D.
Testing was performed by the third-party consultant
Suggested answer: C

Explanation:

The greatest concern for an IS auditor in this scenario is that the user department will manage access rights to the new accounting system. This could pose a significant risk of unauthorized access, segregation of duties violations, data tampering and fraud. The IS auditor should ensure that access rights are defined, approved and monitored by an independent function, such as IT security or internal audit. The other options are not as concerning as option C, as they can be mitigated by other controls or procedures. Data migration is an important part of the system replacement project, but it can be performed by another party or verified by the IS auditor. The timing of the replacement near year-end reporting is a challenge, but it can be managed by proper planning, testing and contingency plans.Testing performed by the third-party consultant is acceptable, as long as it is reviewed and validated by the IS auditor or another independent party.Reference:CISA Review Manual (Digital Version)1, Chapter 3: Information Systems Acquisition, Development & Implementation, Section 3.4: System Implementation.

asked 18/09/2024
Ed Robbins
28 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first