CISA Practice Question: Information Systems Acquisition, Development, and Implementation

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign all administrative rights to a single user for efficiency

  Why it's wrong here

  Granting one user all administrative rights creates the very SoD conflicts the project must prevent, since a single account could both configure and execute transactions without oversight. It is tempting because consolidating rights speeds setup and reduces access tickets, and would suit a small environment where one administrator legitimately owns all functions.

• ✓

  Configure role-based access controls with SoD rules in the system

  Why this is correct

  Embedding SoD rules into role-based access controls means the ERP enforces conflicting-duty separation at design time, preventing toxic combinations such as creating a vendor and approving its payment. Configuring this during implementation satisfies the stem's concern before go-live.

• ✗

  Rely on manual compensating controls after go-live

  Why it's wrong here

  Manual compensating controls detect conflicts only after transactions post, leaving the ERP's own permission model unchanged and reliant on human diligence. They are tempting because they avoid redesigning roles late in a project, and would be appropriate where automated enforcement is technically impossible and detective review is genuinely independent.

• ✗

  Document SoD conflicts for future resolution

  Why it's wrong here

  Documenting conflicts defers remediation indefinitely, so toxic access combinations remain live in production and audit evidence shows known, accepted risk. It is tempting because it preserves the implementation timeline and creates a register for later review, and would suit a low-risk legacy system awaiting decommissioning.

Go deeper

Related to this question