mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Is implementing a new financial system and has…
An organization is implementing a new financial system and has completed user acceptance testing (UAT). The project manager reports that all critical defects have been fixed and retested, but several low-severity issues remain unresolved. What is the BEST course of action?
⚠ Common exam trap
It's easy for candidates to confuse 'all defects must be fixed before go-live' with proper risk management, failing to recognize that ISACA allows go-live with documented, accepted low-severity issues as long as critical defects are resolved and a remediation plan exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the unresolved defects as known issues in a risk acceptance form with a remediation plan, then proceed with go-live
In a financial system implementation, low-severity issues that do not impair core financial processing or controls can be accepted as known risks. Documenting them with a remediation plan and proceeding with go-live aligns with ISACA’s guidance that UAT sign-off does not require zero defects, only that critical and high-severity defects are resolved. This approach balances business needs with risk management, avoiding unnecessary delays while ensuring accountability through formal risk acceptance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document the unresolved defects as known issues in a risk acceptance form with a remediation plan, then proceed with go-live
Why this is correct
Best practice: formally track and accept residual risk.
- ✗
Re-run all UAT test cases to ensure no regression occurs
Why it's wrong here
Too broad; not necessary for low-severity issues.
- ✗
Delay go-live until all defects are resolved
Why it's wrong here
Unnecessary delay for low-severity issues.
- ✗
Obtain sign-off from business stakeholders acknowledging the risks and proceed with go-live
Why it's wrong here
Lacks formal documentation of the known issues.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.