CISA Practice Question: Information Systems Acquisition, Development, and Implementation
A hospital is implementing a new electronic health record (EHR) system to replace a legacy system. During the implementation phase, the project manager proposes using a parallel changeover strategy. Which of the following is the MOST significant risk associated with this approach?
⚠ Common exam trap
The trap here is assuming that parallel changeover eliminates risk because it provides a fallback, but it actually introduces new risks related to data consistency and operational complexity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The need to maintain and reconcile data in both systems, increasing the risk of data inconsistencies.
Parallel changeover involves running both old and new systems concurrently, which introduces significant data reconciliation challenges. In a hospital, where accurate patient data is critical, the risk of inconsistencies between the two systems is the most significant concern. This approach is often chosen for high-risk systems to provide a fallback, but it requires robust controls to ensure data integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The high cost of training users on both systems simultaneously.
Why it's wrong here
While training on two systems may incur additional costs, it is not the most significant risk. The primary concern in a healthcare setting is data integrity and patient safety, which are more directly impacted by data reconciliation issues than by training expenses.
- ✓
The need to maintain and reconcile data in both systems, increasing the risk of data inconsistencies.
Why this is correct
Parallel changeover runs old and new systems simultaneously, requiring dual data entry and reconciliation. In a hospital, this can lead to discrepancies between the legacy EHR and the new system, potentially affecting patient care. The main risk is the complexity and cost of maintaining data integrity across both systems during the overlap period.
- ✗
The inability to roll back to the legacy system if the new system fails.
Why it's wrong here
Parallel changeover actually provides a fallback because the legacy system remains operational. If the new system fails, the organization can revert to the legacy system with minimal disruption. Thus, rollback capability is a strength, not a risk, of this approach.
- ✗
The prolonged project timeline due to extended testing phases.
Why it's wrong here
Parallel changeover does extend the timeline, but the most critical risk is not the duration itself. The extended period increases exposure to data inconsistencies and operational complexity, which are more severe in a clinical environment where errors can harm patients.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.