- Which of the following represents an effective control over interface testing during a system implementation?
Answer: Testing all interfaces between the new system and connected systems by transmitting test transactions and verifying that data is received correctly, completely, and in the correct format by each connected system.
Interface testing requires actually transmitting test data through each interface and verifying end-to-end correctness - confirming that connected systems receive and process data accurately. Answer C is correct. Shared databases (A) are a design choice, not a testing control. Documentation (B, D) addresses design but not operational correctness.
- A company's system implementation project plan includes a 'go/no-go decision gate' before production deployment. The primary purpose of this gate is to:
Answer: Formally evaluate readiness across all critical dimensions (testing, training, migration, interfaces, contingency plans) and provide authorized management sign-off before the system goes live.
A go/no-go gate is a formal governance checkpoint that consolidates all readiness evidence and requires explicit management authorization before go-live - preventing premature deployment when critical items are incomplete. Answer A is correct. Vendor payment (B), team skills assessment (C), and certification review (D) are not the purpose of a go/no-go gate.
- A new revenue recognition system is being implemented. Which of the following testing activities is most critical to ensure the system will produce accurate financial statements?
Answer: End-to-end processing testing that validates revenue recognition rules are correctly configured and produce accurate journal entries across all relevant transaction scenarios.
For financial reporting accuracy, end-to-end processing testing of revenue recognition rules and resulting journal entries is critical - directly validating the financial outputs that will appear in financial statements. Answer C is correct. Load testing (A), usability testing (B), and network testing (D) are important but do not specifically validate financial accuracy.
- Which of the following is the most significant risk of implementing a new financial system without adequate parallel processing?
Answer: Differences between the old and new system outputs may go undetected, and if the new system contains errors, there is no validated baseline to compare against.
Parallel processing runs both systems simultaneously, allowing comparison of outputs to detect discrepancies in the new system before fully committing to it. Without parallel processing, errors in the new system may not be identified until they affect financial reporting. Answer D is correct. License expiry (A), training (B), and vendor support (C) are operational concerns.
- A contract for a new financial system implementation includes provisions for the vendor to provide source code escrow. The primary purpose of source code escrow is to:
Answer: Ensure the organization can access the source code if the vendor goes out of business or fails to maintain the software, protecting the organization from system obsolescence.
Source code escrow protects the organization's business continuity if the vendor fails - the escrow releases the source code under defined conditions so the organization can maintain or transfer the software. Answer A is correct. Source code escrow does not grant modification rights (B). Security auditing (C) may be a separate contractual provision. It does not affect purchase price (D).
- Which of the following best describes the primary purpose of controls over system acquisition and implementation?
Answer: To ensure new systems are authorized, properly configured, adequately tested, and transitioned into production in a controlled manner that maintains data integrity and operational continuity.
System acquisition and implementation controls govern the entire lifecycle from selection through go-live, ensuring systems are authorized, tested, configured correctly, and deployed safely. Answer A is correct. Cost reduction (B), training (C), and licensing (D) are important considerations but not the primary control objective.
- Which of the following is a key control to prevent scope creep from compromising a system implementation project's integrity?
Answer: Implementing a formal change control process requiring business justification, impact assessment, and sponsor approval for all scope changes during the project.
A formal change control process for project scope ensures that any additions are evaluated for impact on timeline, budget, and quality - preventing uncontrolled expansion that can compromise implementation quality and budget. Answer B is correct. Unrestricted changes (A) cause scope creep. Complete rigidity (C) may prevent necessary refinements. IT-only decisions (D) lack business alignment.
- Which of the following represents a significant control weakness in a system implementation project?
Answer: The same individuals who developed and configured the system are also responsible for approving go-live and performing production deployment without independent review.
Having developers approve their own work and deploy to production without independent review eliminates segregation of duties - creating risk of undetected errors and unauthorized changes making it to production. Answer B is correct. Cross-functional teams (A), agile methodology (C), and mixed control types (D) are all appropriate practices.
- An organization implements a new enterprise system using a 'big bang' approach where all modules go live simultaneously. The most significant risk of this approach is:
Answer: If significant issues arise post-go-live, the organization cannot selectively roll back individual modules - the entire implementation may need to be reversed or all issues addressed simultaneously under significant operational pressure.
Simultaneous go-live of all modules concentrates risk - any system problems affect all business functions at once, and remediation is complex when everything is interconnected. Answer D is correct. Vendor support (A), training capacity (B), and project management (C) are manageable challenges compared to the risk of widespread simultaneous failure.
- An organization implements a new fixed asset system. The data migration brings over 5,000 asset records from the legacy system. An auditor tests the migration by comparing a sample of 50 records across key fields between the source and target systems. The auditor finds that 8 records have incorrect depreciation start dates in the new system. This finding indicates:
Answer: A potential systemic migration error affecting the broader population - with a 16% error rate in the sample, the population may contain hundreds of incorrect records requiring investigation and correction before the system is used for reporting.
A 16% error rate on a critical field (depreciation start dates directly affect depreciation calculations and financial reporting) in a sample suggests a systemic problem that likely affects many more records across the full population. Answer D is correct. 8/50 is a significant rate (A). Depreciation dates are critical for accurate expense reporting (B). Targeted remediation may be more efficient than full reversal (C).
- Which of the following best describes the purpose of regression testing during a system upgrade or enhancement?
Answer: Testing that existing functionality continues to work correctly after the upgrade - verifying that new changes did not break previously working features.
Regression testing ensures that changes introduced in an upgrade or enhancement did not inadvertently break existing functionality - a critical safeguard for complex systems where changes can have unintended consequences. Answer B is correct. Security testing (A) and new feature testing (D) are separate test types. Load testing (C) is performance testing.
- During an audit of a recent system implementation, the auditor finds no documented test plans, test scripts, or test results. The system is now in production processing live financial transactions. This finding indicates:
Answer: A significant implementation control deficiency - without documented testing, there is no evidence the system was adequately validated before processing live financial transactions.
Absence of test documentation means there is no evidence that the system was validated - the system may contain errors that will affect financial data integrity, and the risk cannot be assessed retroactively. Answer C is correct. Informal testing (A) leaves no evidence. It is not minor when the system is processing live transactions (B). System scope does not eliminate testing requirements (D).
- During an IT audit, an auditor is evaluating controls over a system implementation completed six months ago. Which of the following audit procedures would most directly assess whether the implementation controls were effective?
Answer: Reviewing project documentation for evidence of completed UAT, data migration reconciliation, go-live authorization, and post-implementation review.
Project documentation review provides direct evidence of whether key implementation controls were applied - testing, migration validation, authorization, and lessons learned. Answer A is correct. Current access lists (B) reflect post-implementation state. Transaction testing (C) reflects current accuracy but not implementation controls specifically. SLA review (D) addresses ongoing operations.
- User acceptance testing (UAT) is performed during system implementation primarily to:
Answer: Confirm that the system meets business requirements and operates correctly from the perspective of end users before go-live.
UAT validates that the system does what the business needs it to do - verifying business requirements are met through user-led testing before the system is deployed to production. Answer C is correct. Technical benchmarks (A) are IT performance testing. Contract fulfillment (B) is a vendor management activity. Security testing (D) is a separate test phase.
- Which of the following system implementation controls most directly addresses the risk that configuration errors in a new financial system will produce incorrect transaction processing?
Answer: Performing comprehensive configuration testing and validation, including processing sample transactions and verifying outputs against expected results.
Configuration testing with sample transactions directly validates that the system's setup produces correct outputs - the most targeted control for detecting configuration errors that could affect transaction accuracy. Answer C is correct. Confidentiality agreements (A) and penetration testing (B) address different risks. Legacy backup (D) is a data protection control, not a configuration validation control.
- A company is evaluating three ERP systems from different vendors. Which of the following represents a key control in the vendor selection process?
Answer: Using a formal RFP process with defined evaluation criteria aligned to business requirements, including financial stability of vendors, security capabilities, and reference checks.
A formal RFP with documented evaluation criteria ensures selection decisions are objective, risk-aware, and aligned to both business and technical requirements. Answer A is correct. Lowest cost (B) ignores TCO and risk. Competitor usage (C) may not fit the organization's specific needs. IT-only selection (D) lacks business alignment.
- An organization is implementing a new payroll system. Which of the following tests should be completed before go-live to specifically address the risk of incorrect payroll calculations?
Answer: Processing a full payroll run with test employee data and reconciling calculated pay to manually computed expected amounts for a representative sample.
Parallel payroll calculation testing - running the new system with known test data and comparing outputs to manually computed expectations - directly validates calculation accuracy before production use. Answer A is correct. Security certifications (B), performance testing (C), and backup verification (D) are important but don't specifically test calculation accuracy.
- During a system implementation project, which of the following represents a key control over data migration from the legacy system to the new system?
Answer: Reconciling record counts and key financial totals between the source (legacy) and target (new) systems after migration to verify completeness and accuracy.
Data migration reconciliation - comparing counts and totals between source and target - directly verifies that all data was transferred completely and accurately, the most critical migration control. Answer B is correct. Broad access (A) increases risk. Immediate deletion (C) eliminates the ability to verify and remediate. Untested migration (D) dramatically increases error risk.
- Which of the following system conversion strategies carries the highest operational risk during a system implementation?
Answer: Direct cutover - immediately switching from the old to the new system on a defined date with no parallel operation.
Direct cutover is highest risk because there is no fallback - if the new system has problems, the organization cannot revert to the old system without significant disruption. Answer D is correct. Parallel (A) is lowest risk. Phased (B) and pilot (C) both provide controlled testing before full deployment.
- An organization upgrades its financial system. The old chart of accounts has 500 accounts and the new system has a revised structure with 450 accounts. Which of the following migration controls is most important?
Answer: Creating and validating a complete account mapping document that specifies how each old account maps to the new structure, and testing a representative sample of transactions using the mapping.
An account mapping document ensures every historical account is correctly mapped to the new structure - preventing transaction history from being lost or misclassified. Testing validates the mapping before migration. Answer D is correct. Direct migration without mapping (A) risks misclassification. Random sampling (B) without a complete map doesn't validate coverage. Deleting the old data (C) before successful migration is premature.
