hardMultiple ChoiceObjective-mapped
Data Migration Integrity: Risks of Cleaning Only at Extraction
During data conversion from a legacy system to a new ERP, the project team decides to clean data during extraction but not during loading. What is the PRIMARY risk associated with this approach?
Quick Answer
The answer is that data integrity issues may remain undetected in the target system. This is correct because cleaning data only during extraction, without a parallel validation during loading, fails to catch problems introduced by the extraction process itself or by schema mapping mismatches—such as referential integrity violations, duplicate keys, or format errors—that only become visible when data lands in the target ERP. On the CISA exam, this scenario tests your understanding of the full data conversion lifecycle and the common trap of assuming a single cleaning pass is sufficient; auditors must recognize that integrity risks persist wherever validation gaps exist. A useful memory tip is “clean twice, trust once”—extraction cleaning removes source grime, but loading cleaning catches mapping scars.
⚠ Common exam trap
The trap here is that candidates focus on operational concerns like speed or cost, rather than the core IS audit principle that data integrity is the paramount risk when data is not validated at the final point of entry into the target system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data integrity issues may remain undetected in the target system.
Cleaning data only during extraction and not during loading means that any data quality issues introduced during the extraction process or that become apparent only after mapping to the target schema will not be caught. This creates a primary risk that data integrity issues—such as referential integrity violations, duplicate keys, or format mismatches—will remain undetected in the new ERP system, potentially corrupting business operations and reporting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data integrity issues may remain undetected in the target system.
Why this is correct
Errors can be introduced after extraction, so cleaning only at source is insufficient.
- ✗
The legacy system performance may degrade.
Why it's wrong here
Data extraction from legacy is a batch process, unlikely to degrade performance.
- ✗
The project may exceed its budget due to rework.
Why it's wrong here
While possible, the primary risk is data integrity.
- ✗
The conversion process will be significantly slower.
Why it's wrong here
Cleaning during loading can also be time-consuming.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are essential controls to ensure data integrity during a cloud migration project?
medium- A.Granting all migration team members full database access
- ✓ B.Implementing encryption at rest and in transit
- C.Using a phased migration approach without rollback capability
- ✓ D.Running reconciliation checks comparing source and target data counts
- E.Performing a single full data validation after migration
Why B: Encryption at rest and in transit (Option B) is essential for maintaining data integrity during cloud migration because it prevents unauthorized modification or corruption of data while stored in the source or target systems and while being transferred over networks. Without encryption, data is vulnerable to tampering, which directly undermines integrity. This control aligns with the principle of protecting data throughout its lifecycle, a key requirement in cloud migration projects.
Variation 2. An organization is replacing its legacy customer relationship management (CRM) system. Which of the following is the MOST important control to ensure data integrity during the data conversion process?
easy- ✓ A.Perform reconciliation of total record counts and key field sums before and after conversion.
- B.Implement encryption for data in transit during migration.
- C.Conduct user acceptance testing on the new system.
- D.Ensure data mapping documents are approved by business owners.
Why A: Performing reconciliation of total record counts and key field sums before and after conversion is a direct control to verify that data is accurately transferred without loss or corruption. This ensures data integrity. Option B, implementing encryption for data in transit, is important for security but does not directly address data integrity during conversion. Option C, conducting user acceptance testing, focuses on functionality and user requirements, not on the accuracy of the converted data. Option D, ensuring data mapping documents are approved, is a governance control but does not provide verification of actual data integrity during the conversion process.
Variation 3. During a data migration from a legacy system to a new ERP, the following log entries were generated. Which TWO issues should the IS auditor flag as high risk?
easy- A.Source system downtime
- B.Rapid growth of rollback segment
- ✓ C.Constraint violation due to missing parent records
- ✓ D.Duplicate key violation
- E.Data type mismatch between source and target
Why C: A constraint violation due to missing parent records indicates a referential integrity failure. In a data migration, this means child records are being inserted without their corresponding parent records, which can cause orphaned data and application logic errors. This is a high-risk issue as it compromises data consistency and may require complex reconciliation or rollback.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.