mediumMultiple Choice
CISA Is implementing a custom ERP system Practice Question
An organization is implementing a custom ERP system. During user acceptance testing (UAT), critical bugs are found that affect core financial processing. The project sponsor suggests deploying the system on schedule and fixing bugs after go-live. What is the BEST course of action?
⚠ Common exam trap
Test-takers frequently confuse 'risk acceptance' (Option C) as a valid management decision, but in the context of critical financial processing bugs, ISACA standards require resolution before go-live because accepted risks cannot ensure the integrity of financial data and auditability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Delay go-live until all critical bugs are resolved and UAT is successfully completed
Deploying an ERP system with unresolved critical bugs in core financial processing violates the fundamental principle of system integrity and accuracy. UAT must be successfully completed to validate that the system meets business requirements and processes financial transactions correctly; going live with known critical defects introduces unacceptable risk of financial misstatement, regulatory non-compliance, and data corruption. Delaying go-live ensures that all critical bugs are resolved and retested, preserving the reliability of financial data and audit trails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Delay go-live until all critical bugs are resolved and UAT is successfully completed
Why this is correct
Critical bugs affecting core financial processing mean the system cannot meet acceptance criteria; deploying anyway risks material financial misstatement. Delaying go-live until bugs are resolved and UAT passes satisfies the control objective that only validated systems enter production.
- ✗
Go live as planned and fix bugs post-implementation
Why it's wrong here
Deploying with known critical financial bugs transfers defect risk to production, where remediation costs and data corruption are far greater. This option is tempting when schedule pressure dominates, but UAT exit criteria require critical defects to be resolved or formally accepted with compensating controls before go-live.
- ✗
Accept the bugs with documented risk acceptance from management
Why it's wrong here
Management risk acceptance transfers ownership of the decision but does not make defective financial processing acceptable; the bugs must be fixed and retested before go-live. Documented risk acceptance suits low-impact residual risks, such as cosmetic defects or minor reporting delays, not core financial integrity failures.
- ✗
Go live but include a rollback plan and deploy fixes immediately
Why it's wrong here
A rollback plan does not prevent corrupted financial postings from entering production; UAT failures in core financial processing must be remediated and retested before go-live. Rollback planning belongs to deployment risk management for non-critical releases, where reverting is acceptable and data integrity is not compromised.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.