nerdexam
Isaca

CISA · Question #42

Which of the following should be of GREATEST concern to an IS auditor reviewing project documentation for a client relationship management (CRM) system migration project?

The correct answer is D. A single implementation phase is planned and the legacy system will be immediately. An IS auditor should be most concerned about a single implementation phase with immediate legacy system cutover, as this approach introduces significant risk without a fallback plan.

Submitted by yousef_jo· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Which of the following should be of GREATEST concern to an IS auditor reviewing project documentation for a client relationship management (CRM) system migration project?

Options

  • AFive weeks prior to the target date, there are still numerous defects in the printing functionality.
  • BThe technical migration is planned for a holiday weekend and end users may not be available.
  • CEmployees are concerned that data representation in the new system is completely different from
  • DA single implementation phase is planned and the legacy system will be immediately

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    30% (8)
  • C
    15% (4)
  • D
    48% (13)

Why each option

An IS auditor should be most concerned about a single implementation phase with immediate legacy system cutover, as this approach introduces significant risk without a fallback plan.

AFive weeks prior to the target date, there are still numerous defects in the printing functionality.

Numerous defects in printing functionality five weeks prior to the target date are concerning but represent specific bugs that can be tracked and resolved within the project timeline, not a fundamental flaw in the migration strategy itself.

BThe technical migration is planned for a holiday weekend and end users may not be available.

A holiday weekend migration may impact user availability for testing, but proper pre-migration testing and communication can mitigate this, and it does not inherently preclude a rollback strategy or phased approach.

CEmployees are concerned that data representation in the new system is completely different from

Employee concerns about data representation indicate a need for user training and change management, which are important project aspects but not as critical as the architectural risk of a full cutover without a contingency plan.

DA single implementation phase is planned and the legacy system will be immediatelyCorrect

A single-phase 'big bang' implementation with immediate cutover, especially for a critical system like CRM, is high-risk because it lacks a phased rollout or parallel run for validation and leaves no immediate fallback option if severe issues arise post-implementation. This approach can lead to significant business disruption if not meticulously planned and tested, and auditor concern arises from the lack of a graceful recovery strategy.

Concept tested: Project migration risk management

Source: https://www.isaca.org/resources/isaca-journal/isaca-journal-archives/2021/volume-3/auditing-software-migrations

Topics

#System migration#Big bang implementation#Project risk#IS audit

Community Discussion

No community discussion yet for this question.

Full CISA Practice