CISA Domain 3B-4 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain B-4 (Post-implementation Review) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3B-4 Post-implementation Review Practice Test 002

10 questions • Single best answer

Question 1

A municipal government's internal audit function is asked to assess the post-implementation review of a new building-permit system. The review was planned, performed, and signed off by the project manager who led the implementation, and it concluded that all project objectives were achieved. Which of the following is the IS auditor's GREATEST concern?

A. The review did not compare delivered functionality against the vendor's original technical proposal. B. The review was completed before the final vendor invoices for the project had been paid. C. The review lacks objectivity because the reviewer was accountable for delivering the system. D. The review report followed a project office template rather than an internal audit reporting format.

Question 2

A regional insurer placed its new policy administration system into production two weeks ago, and the steering committee wants the post-implementation review finished before month-end so the project can be closed. Several processing cycles, including quarterly renewals, have not yet run in production. What is the IS auditor's BEST recommendation regarding the review?

A. Schedule the review after key processing cycles have run so that benefits and controls are assessed on actual operations. B. Proceed as planned and base the review conclusions on user acceptance testing results and signed test scripts. C. Proceed as planned but limit the review scope to project budget and schedule variance analysis only. D. Defer the review until every post-go-live change request raised by users has been fully implemented.

Question 3

During a post-implementation review of a hospital's automated pharmacy dispensing system, an IS auditor is evaluating whether the business case benefit of a 30 percent reduction in dispensing errors has been realized. The system has operated in production for nine months. Which of the following provides the BEST evidence?

A. A written attestation from pharmacy managers that error rates have noticeably declined since go-live B. Case studies published by the vendor showing similar error reductions at comparable hospitals C. Results of the satisfaction survey completed by pharmacists after the system training sessions D. A comparison of documented pre-implementation baseline error rates with error rates measured after go-live

Question 4

A post-implementation review of a pension fund's new contributions platform finds that processing is accurate and the system operates as designed. However, the IS auditor notes that consultant and developer accounts created with administrative privileges during implementation remain active three months after go-live. Which recommendation is MOST appropriate?

A. Require the consultants and developers to change their passwords and enroll their accounts in multifactor authentication. B. Disable implementation-era accounts and review remaining privileged access against current production support roles. C. Increase logging on the administrative accounts and have the security team review the logs every month. D. Record the accounts as an accepted risk because the platform has processed contributions accurately to date.

Question 5

An audit manager reviewing the last three post-implementation reviews at a telecommunications company finds that each identified the same weaknesses: incomplete requirements traceability and late involvement of security staff. The findings were recorded in each project's closure file, but no one was assigned to act on them. Which recommendation would BEST address the root cause?

A. Assign ownership for incorporating PIR lessons learned into the SDLC methodology and track them to completion. B. Require every future project to perform a second post-implementation review six months after the first review. C. Escalate the recurring findings to the external auditor so they are included in the annual management letter. D. Require the security team to sign off on project closure before each post-implementation review report is issued.

Question 6

A logistics firm's post-implementation review of a new route-optimization system relies primarily on a user satisfaction survey, which shows high approval ratings. The IS auditor needs to determine whether the approved functional requirements were actually delivered and are operating in production. Which approach provides the MOST reliable basis for that conclusion?

A. Interviewing dispatch supervisors about how the system has changed their daily routing operations B. Reviewing the vendor's release notes that list the features included in the deployed version C. Tracing approved requirements through the traceability matrix to test results and production operation D. Expanding the survey to more user groups so that the approval rating is statistically representative

Question 7

During a post-implementation review of a university's new financial aid system, an IS auditor observes that staff maintain a spreadsheet to manually recalculate award amounts before each disbursement. Staff explain that the system occasionally produces incorrect totals, and the workaround was never reported to the project team. What should the IS auditor do FIRST?

A. Recommend that the spreadsheet be protected with access restrictions and formal version control. B. Determine the cause and extent of the calculation errors and whether a requirement was not met. C. Report the workaround to the steering committee as a failed implementation that requires rollback. D. Recommend that the vendor be required to issue a corrective patch under the contract warranty.

Question 8

At go-live of a state agency's online tax filing portal, the steering committee accepted twelve known defects on the condition that they be fixed within 60 days. The post-implementation review, performed four months later, recommends formal project closure but makes no mention of those defects. Which finding is MOST significant for the IS auditor to report?

A. The post-implementation review was performed later than the timeline originally defined in the project plan. B. The steering committee chose to accept known defects rather than delaying the portal's go-live date. C. The post-implementation review report did not include a detailed cost-variance analysis for the project. D. The status of the conditionally accepted defects was not verified before project closure was recommended.

Question 9

A post-implementation review of a manufacturer's new ERP production-planning module shows that forty changes were migrated directly to production during the first month after go-live under a hypercare exception, without standard change approval. The IS auditor confirms that the hypercare period has formally ended. What is the auditor's BEST course of action?

A. Verify that hypercare changes were retrospectively reviewed and authorized and that normal change control resumed. B. Recommend that all forty changes be rolled back and redeployed through the standard change management process. C. Conclude that the module's controls are ineffective and issue an adverse opinion on the overall implementation. D. Accept the exception because hypercare was sanctioned by project management and has since formally ended.

Question 10

An IS auditor completes a post-implementation review of a bank's new anti-money-laundering transaction monitoring system and finds that several alert-generation rules defined in the approved requirements were never configured. The project team disputes the significance of the finding and wants the project closed. To whom should the IS auditor PRIMARILY communicate the results?

A. The vendor's implementation lead, who was contractually responsible for configuring the monitoring rules B. The project manager alone, since the project team is responsible for resolving gaps before project closure C. The system's business owner and project sponsor, with escalation to the audit committee given its significance D. The bank's financial regulator directly, because the configuration gap affects anti-money-laundering obligations

Related Posts

Leave a Comment Cancel Reply