Which of the following should be of GREATEST concern to an IS auditor reviewing hardware maintenance practices in an organization whose primary business is e-commerce?

Question

Options

• AHardware maintenance plan was not approved by the risk manager
• BSystem uptime was 5% below the average target range
• CResource utilization was 5% above the average target range
• DHardware maintenance costs exceeded budget by 5%

• A
  14% (6)
• B
  58% (25)
• C
  23% (10)
• D
  5% (2)

Explanation

For an e-commerce business, system availability is mission-critical - downtime directly translates to lost revenue, failed transactions, and customer attrition. System uptime falling 5% below target means the business was unavailable to customers for a measurable, recurring period, making this the highest-impact finding an IS auditor should escalate.

Why the distractors fall short:

• A - Approval by a risk manager is a process concern, but the absence of that approval doesn't necessarily mean systems are at risk; it's a governance gap, not an operational failure.
• C - Resource utilization running 5% above average is worth monitoring but doesn't indicate a failure has occurred; it may simply reflect business growth.
• D - A 5% budget overrun is a financial management issue, not a risk to the organization's ability to operate or serve customers.

Memory tip: In IT auditing, always anchor your thinking to the organization's primary business function. For e-commerce, availability = revenue. Any finding that directly threatens uptime outranks process, cost, or capacity concerns on the risk scale.

No community discussion yet for this question.