Which of the following is MOST important for an IS auditor to review prior to the migration of acquired software into production?

Question

Options

• AUser acceptance test (UAT) report
• BVendor testing report
• CExpected return on investment (ROI)
• DSource code escrow agreement

• A
  74% (14)
• B
  16% (3)
• C
  5% (1)
• D
  5% (1)

Explanation

User Acceptance Testing (UAT) report is the most critical review item because it provides documented evidence that end users validated the software meets business requirements before production deployment - this is the auditor's primary control checkpoint to confirm the software is fit for purpose and formally approved.

Why the distractors are wrong:

• B (Vendor testing report): Vendor testing confirms the software works as the vendor designed it, not that it meets your organization's specific needs - it's necessary but insufficient on its own.
• C (Expected ROI): ROI is a pre-acquisition business case concern, not a pre-production migration control - the investment decision has already been made at this stage.
• D (Source code escrow agreement): Escrow is a business continuity safeguard (ensuring code access if the vendor fails), valuable long-term but irrelevant to whether the software is ready to go live.

Memory tip: Think "production gate = user sign-off." The UAT report is the formal handshake between business users and IT confirming readiness - no UAT signature, no go-live. An IS auditor's job is to verify that gate was properly crossed.

No community discussion yet for this question.