easyMultiple Choice
CISA Practice Question: A mid-sized company is upgrading its legacy…
A mid-sized company is upgrading its legacy financial system to a new cloud-based ERP. The project manager has decided to use a big-bang cutover approach to minimize costs and time. During the first week post-go-live, users report that several critical reports are generating incorrect totals. An initial investigation reveals that the data mapping from the old system to the new system was not fully validated. Which of the following should the IS auditor recommend as the most appropriate corrective action?
⚠ Common exam trap
Many exam-takers choose Option D (revert to legacy) because it seems safest, but the CISA exam emphasizes cost-effective, risk-based corrective actions that validate data integrity without abandoning the project, making parallel operations the preferred approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a data mapping review and remediation, then run parallel operations until accuracy is confirmed
A big-bang cutover with unvalidated data mapping introduces a high risk of data integrity issues, as seen with the incorrect report totals. Running parallel operations after a data mapping review and remediation allows the IS auditor to validate that the new ERP processes data correctly by comparing outputs with the legacy system, ensuring accuracy before full reliance. This aligns with ISACA's guidance on post-implementation verification and control testing for data conversion in cloud-based ERP migrations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Perform a data mapping review and remediation, then run parallel operations until accuracy is confirmed
Why this is correct
Big-bang cutover removed the reconciliation window, so the unvalidated mapping corrupted report totals. Reviewing and remediating the mapping, then running parallel operations, restores accuracy evidence before trusting the new ERP as the sole system of record.
- ✗
Implement additional manual controls and have users double-check all reports
Why it's wrong here
Manual double-checking leaves the faulty mapping in place and relies on users to catch errors indefinitely. Manual controls are a compensating measure for residual risk, not a corrective action that fixes the migration defect itself.
- ✗
Increase the project budget and hire more consultants to fix the issues
Why it's wrong here
More budget and consultants treats the symptom without correcting the unvalidated data mapping that produced the wrong totals. Additional resources suit capacity or skills shortfalls, not a defect requiring re-mapping and reconciliation of migrated data.
- ✗
Immediately revert to the legacy system and restart the project with a phased approach
Why it's wrong here
Reverting and restarting discards the working system and repeats the whole project, when the identified cause is unvalidated data mapping. A phased approach addresses cutover risk, not the mapping defect that actually caused the incorrect totals.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.