CISA Domain 3B-4 Practice Test 001

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain B-4 (Post-implementation Review) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3B-4 Post-implementation Review Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor is conducting a post-implementation review of a newly deployed claims-processing system at a large insurance company. Executive management has requested assurance that the significant investment delivered the value promised when the project was originally approved. Several months have now passed since go-live. Which of the following should the auditor examine FIRST?

A. The results of the user acceptance testing that was completed shortly before the final go-live decision B. The realized benefits measured against the objectives stated in the approved business case C. The adequacy of the system's data backup and recovery procedures currently in operation D. The training records for the claims-processing staff that were compiled after deployment

Question 2

A retail organization deployed a new point-of-sale system just three weeks ago and has asked an IS auditor to begin the post-implementation review immediately. Sales and transaction volumes are still fluctuating widely as store staff continue to adjust to the new checkout process. What is the auditor's BEST course of action?

A. Begin the review at once, because identifying issues early will prevent any erosion of the projected benefits B. Limit the review to confirming that the appropriate go-live approvals were obtained before deployment C. Recommend delaying the review until the system has operated long enough to produce representative results D. Postpone the review until it can be combined with the next scheduled annual audit cycle

Question 3

A government agency completed a post-implementation review of a new licensing system and reported the project a clear success because it was delivered on time and within the approved budget. An IS auditor has been asked to assess the quality and completeness of that review. Which conclusion is MOST appropriate?

A. The review is incomplete because it did not assess whether the intended business benefits were actually realized B. The review is adequate because on-time and on-budget delivery reliably confirms overall project success C. The review is inadequate mainly because it omitted a formal performance rating of the system vendor D. The review is complete because adherence to the approved budget is the key measure of success

Question 4

During a post-implementation review of a bank's new loan-origination system, an IS auditor learns that the review was performed entirely by the same project team that designed, built, and delivered the system. The team's report concluded that all project objectives had been fully met. Which of the following is the auditor's MOST significant concern?

A. The project team may not have retained all of the original detailed technical specification documents B. The project team completed its review somewhat later than the date originally scheduled for it C. The project team did not invite a representative group of end users to the review meetings D. The project team's involvement impairs the objectivity of the review's conclusions

Question 5

An IS auditor is evaluating the post-implementation review of an enterprise procurement system. The approved business case projected a 20 percent reduction in purchase-order processing costs within the first year of operation. Management now asserts that this target has been met. Which of the following provides the BEST evidence that the benefit was actually achieved?

A. A signed memo from the project sponsor confirming that overall processing costs have clearly decreased since go-live B. Actual processing-cost metrics captured after go-live and compared to the documented pre-implementation baseline C. Positive responses from a user satisfaction survey about the new procurement system's overall ease of use D. Confirmation that every planned system feature was delivered on the originally agreed project schedule

Question 6

A healthcare provider's post-implementation review of a new electronic health record system found that the expected clinical-efficiency gains have not materialized six months after go-live. Clinicians report that the system works reliably, but many routine processes now feel slower than before. Which recommendation should the IS auditor consider MOST appropriate?

A. Perform a root-cause analysis to determine why the benefits were not achieved and identify corrective actions B. Conclude that the overall project has failed and recommend that the entire system be decommissioned soon C. Extend the post-implementation review period indefinitely until the projected benefits eventually appear D. Attribute the shortfall to user resistance and formally close out the review as complete

Question 7

During a post-implementation review of a logistics company's new transportation management system, an IS auditor wants to confirm that the automated application controls designed during the project are functioning as intended now that the system is live in production. Which of the following approaches would provide the BEST assurance?

A. Reviewing the detailed control-design documentation that the project team prepared during the development phase B. Confirming that the automated controls passed all of their tests before the scheduled go-live date C. Interviewing the developers about how each of the automated controls was originally coded and configured D. Testing a sample of live production transactions to verify the controls operate as designed

Question 8

A post-implementation review of a manufacturer's new warehouse management system reveals that no process was ever established to measure whether the projected inventory-accuracy improvements are being achieved. Management is satisfied simply because the new system runs smoothly each day. Which of the following is the MOST significant implication of this finding?

A. The system's user documentation will likely need to be updated before the next planned release B. The help desk may continue to receive additional support calls throughout the stabilization period C. The organization cannot demonstrate whether the investment actually delivered its intended value D. The vendor's ongoing support and maintenance contract may need to be renegotiated fairly soon

Question 9

An IS auditor is planning a post-implementation review of a recently deployed customer billing system at a utility company. To evaluate objectively whether the project met its objectives, the auditor must first establish the criteria for success. Which of the following sources provides the MOST reliable basis for defining those criteria?

A. A series of interviews with current system users about their day-to-day preferences and expectations B. The approved business case together with the formally documented project requirements C. The software vendor's marketing materials describing the product's advertised capabilities D. The project manager's personal recollection of what the original project goals were said to be

Question 10

An IS auditor has completed a post-implementation review of a public university's new student information system and documented several unrealized benefits along with valuable lessons learned about scope and cost estimation during the project. To maximize the organizational value of these results, which action should the auditor recommend?

A. Communicate the lessons learned to governance so they can inform future project approvals and reviews B. Archive the completed review report and take no further action until the next scheduled audit cycle C. Restrict the documented findings solely to the project team that originally delivered the new system D. Delay reporting the lessons learned until the projected benefits are eventually and fully achieved

Related Posts