CPA Isc Quiz: Evaluate System Acquisition And Implementation Controls

What this quiz covers

This quiz focuses on Evaluate System Acquisition And Implementation Controls, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. The old system's licenses may expire before the new system is fully deployed.
2. IT staff may not be adequately trained on the new system before go-live.
3. The new system's vendor may not provide timely support after implementation.
4. Differences between the old and new system outputs may go undetected, and if the new system contains errors, there is no validated baseline to compare against. (correct answer)

Explanation: Parallel processing runs both systems simultaneously, allowing comparison of outputs to detect discrepancies in the new system before fully committing to it. Without parallel processing, errors in the new system may not be identified until they affect financial reporting. Answer D is correct. License expiry (A), training (B), and vendor support (C) are operational concerns.

Question 2

1. The system was tested informally and the results were adequate.
2. A minor documentation gap that can be remediated through post-implementation review.
3. A significant implementation control deficiency - without documented testing, there is no evidence the system was adequately validated before processing live financial transactions. (correct answer)
4. An acceptable practice for small, low-risk system implementations.

Explanation: Absence of test documentation means there is no evidence that the system was validated - the system may contain errors that will affect financial data integrity, and the risk cannot be assessed retroactively. Answer C is correct. Informal testing (A) leaves no evidence. It is not minor when the system is processing live transactions (B). System scope does not eliminate testing requirements (D).

Question 3

1. Confirming that the new system and legacy system share the same database.
2. Ensuring all interfaces are documented in the system architecture diagram.
3. Testing all interfaces between the new system and connected systems by transmitting test transactions and verifying that data is received correctly, completely, and in the correct format by each connected system. (correct answer)
4. Confirming that all interface documentation was reviewed by IT management.

Explanation: Interface testing requires actually transmitting test data through each interface and verifying end-to-end correctness - confirming that connected systems receive and process data accurately. Answer C is correct. Shared databases (A) are a design choice, not a testing control. Documentation (B, D) addresses design but not operational correctness.

Question 4

1. Parallel conversion - running both the old and new systems simultaneously.
2. Phased conversion - implementing the new system in stages across business units.
3. Pilot conversion - implementing the new system in one location first.
4. Direct cutover - immediately switching from the old to the new system on a defined date with no parallel operation. (correct answer)

Explanation: Direct cutover is highest risk because there is no fallback - if the new system has problems, the organization cannot revert to the old system without significant disruption. Answer D is correct. Parallel (A) is lowest risk. Phased (B) and pilot (C) both provide controlled testing before full deployment.

Question 5

1. Assess the risk of the missing interface, develop a manual workaround if needed, and consider delaying go-live until the interface is complete or formally accepting the risk with management approval and documented compensating controls. (correct answer)
2. Proceed with go-live as planned and hope the interface issue can be resolved quickly in production.
3. Cancel the implementation project entirely and revert to the legacy system indefinitely.
4. Complete the interface by removing all testing requirements to meet the deadline.

Explanation: Incomplete critical interfaces require a formal risk decision - delay, workaround, or formal risk acceptance with compensating controls - not ad hoc deployment or elimination of testing. Answer A is correct. Deploying without resolving the issue (B) creates unacceptable operational risk. Cancellation (C) is an extreme measure. Eliminating testing (D) introduces additional uncontrolled risk.

Question 6

1. Ensuring all 500 old accounts are created in the new system without mapping.
2. Randomly sampling 50 accounts to verify they migrated correctly.
3. Deleting the old chart of accounts before beginning the migration.
4. Creating and validating a complete account mapping document that specifies how each old account maps to the new structure, and testing a representative sample of transactions using the mapping. (correct answer)

Explanation: An account mapping document ensures every historical account is correctly mapped to the new structure - preventing transaction history from being lost or misclassified. Testing validates the mapping before migration. Answer D is correct. Direct migration without mapping (A) risks misclassification. Random sampling (B) without a complete map doesn't validate coverage. Deleting the old data (C) before successful migration is premature.

Question 7

1. The migration was successful since only 8 of 50 sampled records had errors.
2. The errors are immaterial since depreciation dates are a minor data element.
3. The migration should be immediately reversed and restarted.
4. A potential systemic migration error affecting the broader population - with a 16% error rate in the sample, the population may contain hundreds of incorrect records requiring investigation and correction before the system is used for reporting. (correct answer)

Explanation: A 16% error rate on a critical field (depreciation start dates directly affect depreciation calculations and financial reporting) in a sample suggests a systemic problem that likely affects many more records across the full population. Answer D is correct. 8/50 is a significant rate (A). Depreciation dates are critical for accurate expense reporting (B). Targeted remediation may be more efficient than full reversal (C).

Question 8

1. Reviewing project documentation for evidence of completed UAT, data migration reconciliation, go-live authorization, and post-implementation review. (correct answer)
2. Reviewing the current system's access control list.
3. Testing current period financial transactions for accuracy.
4. Reviewing the vendor's service level agreement.

Explanation: Project documentation review provides direct evidence of whether key implementation controls were applied - testing, migration validation, authorization, and lessons learned. Answer A is correct. Current access lists (B) reflect post-implementation state. Transaction testing (C) reflects current accuracy but not implementation controls specifically. SLA review (D) addresses ongoing operations.

Question 9

1. To ensure new systems are authorized, properly configured, adequately tested, and transitioned into production in a controlled manner that maintains data integrity and operational continuity. (correct answer)
2. To reduce the cost of technology procurement by standardizing vendor selection criteria.
3. To ensure IT staff receive adequate training on new system functionality.
4. To comply with vendor licensing agreements for all purchased software.

Explanation: System acquisition and implementation controls govern the entire lifecycle from selection through go-live, ensuring systems are authorized, tested, configured correctly, and deployed safely. Answer A is correct. Cost reduction (B), training (C), and licensing (D) are important considerations but not the primary control objective.

Question 10

1. Verify that the system meets technical performance benchmarks established by IT.
2. Ensure the vendor has fulfilled all contractual obligations before payment.
3. Confirm that the system meets business requirements and operates correctly from the perspective of end users before go-live. (correct answer)
4. Test the system's cybersecurity controls against known attack vectors.

Explanation: UAT validates that the system does what the business needs it to do - verifying business requirements are met through user-led testing before the system is deployed to production. Answer C is correct. Technical benchmarks (A) are IT performance testing. Contract fulfillment (B) is a vendor management activity. Security testing (D) is a separate test phase.

Question 11

1. Using a formal RFP process with defined evaluation criteria aligned to business requirements, including financial stability of vendors, security capabilities, and reference checks. (correct answer)
2. Selecting the vendor with the lowest upfront licensing cost.
3. Selecting the system used by the largest number of competitors.
4. Delegating vendor selection entirely to the IT department without business unit involvement.

Explanation: A formal RFP with documented evaluation criteria ensures selection decisions are objective, risk-aware, and aligned to both business and technical requirements. Answer A is correct. Lowest cost (B) ignores TCO and risk. Competitor usage (C) may not fit the organization's specific needs. IT-only selection (D) lacks business alignment.

Question 12

1. Requiring all project team members to sign confidentiality agreements.
2. Conducting cybersecurity penetration testing of the new system before go-live.
3. Performing comprehensive configuration testing and validation, including processing sample transactions and verifying outputs against expected results. (correct answer)
4. Backing up all legacy system data before beginning the implementation.

Explanation: Configuration testing with sample transactions directly validates that the system's setup produces correct outputs - the most targeted control for detecting configuration errors that could affect transaction accuracy. Answer C is correct. Confidentiality agreements (A) and penetration testing (B) address different risks. Legacy backup (D) is a data protection control, not a configuration validation control.

Question 13

1. The project team includes both IT developers and business analysts.
2. The same individuals who developed and configured the system are also responsible for approving go-live and performing production deployment without independent review. (correct answer)
3. The project uses an agile development methodology with two-week sprints.
4. The system has both automated and manual controls.

Explanation: Having developers approve their own work and deploy to production without independent review eliminates segregation of duties - creating risk of undetected errors and unauthorized changes making it to production. Answer B is correct. Cross-functional teams (A), agile methodology (C), and mixed control types (D) are all appropriate practices.

Question 14

1. Processing a full payroll run with test employee data and reconciling calculated pay to manually computed expected amounts for a representative sample. (correct answer)
2. Reviewing the new payroll system's vendor security certifications.
3. Testing the system's report generation speed and performance under peak load.
4. Verifying that the payroll system is backed up nightly.

Explanation: Parallel payroll calculation testing - running the new system with known test data and comparing outputs to manually computed expectations - directly validates calculation accuracy before production use. Answer A is correct. Security certifications (B), performance testing (C), and backup verification (D) are important but don't specifically test calculation accuracy.

Question 15

1. Training all accounting staff on the new system before data migration.
2. Reconciling migrated historical data balances by period to the legacy system's audited financial statements and prior period trial balances. (correct answer)
3. Encrypting all historical data during the migration process.
4. Archiving the legacy system data in a separate storage location after migration.

Explanation: Reconciling migrated historical data to audited financial statements ensures comparative period data is accurate - directly addressing the risk of historical data errors in the new system. Answer B is correct. Training (A) addresses operational readiness. Encryption (C) addresses security. Archiving (D) addresses retention.

Question 16

1. Testing that the upgraded system meets new security requirements.
2. Testing that existing functionality continues to work correctly after the upgrade - verifying that new changes did not break previously working features. (correct answer)
3. Testing the system's performance under maximum expected load.
4. Testing that new features added in the upgrade function as designed.

Explanation: Regression testing ensures that changes introduced in an upgrade or enhancement did not inadvertently break existing functionality - a critical safeguard for complex systems where changes can have unintended consequences. Answer B is correct. Security testing (A) and new feature testing (D) are separate test types. Load testing (C) is performance testing.

Question 17

1. Ensuring all project team members have administrative access to both systems.
2. Reconciling record counts and key financial totals between the source (legacy) and target (new) systems after migration to verify completeness and accuracy. (correct answer)
3. Deleting all data from the legacy system immediately after migration begins.
4. Migrating data without testing to minimize the project timeline.

Explanation: Data migration reconciliation - comparing counts and totals between source and target - directly verifies that all data was transferred completely and accurately, the most critical migration control. Answer B is correct. Broad access (A) increases risk. Immediate deletion (C) eliminates the ability to verify and remediate. Untested migration (D) dramatically increases error risk.

Question 18

1. Configuring the on-premises database servers to synchronize with the cloud application.
2. Reviewing and configuring the SaaS application's security and access control settings, since the vendor controls the underlying infrastructure and the organization is responsible for application-level configuration. (correct answer)
3. Installing the SaaS application on all employee workstations.
4. Negotiating the physical location of the servers hosting the SaaS application.

Explanation: In a SaaS model, the organization cannot control infrastructure but is fully responsible for configuring application-level security, access controls, and data settings - a critical implementation control in cloud deployments. Answer B is correct. On-premises database configuration (A) is not applicable to SaaS. Local installation (C) is not how SaaS works. Physical server location (D) may be relevant for data residency but is not the most critical implementation control.

Question 19

1. Conducting final vendor contract negotiations.
2. Completing user acceptance testing sign-off.
3. Performing a post-implementation review (PIR) to assess whether the system met its objectives, identify issues, and capture lessons learned. (correct answer)
4. Finalizing the system architecture design documentation.

Explanation: A PIR after go-live evaluates whether the system delivered its intended benefits, identifies post-production issues, and captures process improvements for future projects - closing the implementation lifecycle. Answer C is correct. Contract negotiations (A) and UAT (B) occur before go-live. Architecture documentation (D) should be completed during, not after, implementation.

Question 20

1. Allowing all stakeholders to submit change requests at any time without review.
2. Implementing a formal change control process requiring business justification, impact assessment, and sponsor approval for all scope changes during the project. (correct answer)
3. Freezing all project requirements at initiation with no possibility of modification.
4. Delegating scope change decisions entirely to the IT development team.

Explanation: A formal change control process for project scope ensures that any additions are evaluated for impact on timeline, budget, and quality - preventing uncontrolled expansion that can compromise implementation quality and budget. Answer B is correct. Unrestricted changes (A) cause scope creep. Complete rigidity (C) may prevent necessary refinements. IT-only decisions (D) lack business alignment.