Which of the following should be done by an IS auditor during a post-implementation review of a critical application that has been operational for six months?
Which of the following should be done by an IS auditor during a post-implementation review of a critical application that has been operational for six months?
During a post-implementation review of a critical application that has been operational for six months, the IS auditor should examine project change request logs. This process is essential to understand any modifications made to the application since it went live, ensuring such changes were properly authorized, documented, and evaluated for potential impacts on system performance and security. Monitoring the change request logs is crucial for assessing the effectiveness of the change management process and maintaining the application's stability and integrity. Other activities, such as testing system interfaces or verifying data conversions, are typically more relevant during earlier stages of implementation.
D. Examine project change request logs. During a post-implementation review of a critical application that has been operational for six months, the IS auditor should examine project change request logs. This is important because it allows the auditor to review any changes made to the application after it went live. Examining change request logs helps assess whether changes were properly authorized, documented, and tested, and whether they have had any unexpected impacts on the system's performance or security. It also provides insights into the change management process, which is a crucial aspect of maintaining the application's stability and integrity. While the other options mentioned (testing program system interfaces, verifying data conversions, and assessing project management risk reports) are important activities, examining change request logs specifically addresses post-implementation change management, which is a critical aspect of maintaining the application's reliability and security.
Correct answer is B. Verify the accuracy of data conversions.
Why not D? The question doesn't mention anything about data conversions.
While verifying the accuracy of data conversions (Option B) may also be important, it is typically performed during the initial implementation phase rather than in a post-implementation review conducted six months later. Data conversions are crucial to ensure the integrity and completeness of data migrated to the new application, but verifying their accuracy is typically part of the implementation validation process.