CISA Practice Question: Information Systems Acquisition, Development, and Implementation
During an ERP implementation, the project team decides to customize the software to align with existing business processes. Which of the following risks is MOST likely to increase as a result of extensive customization?
⚠ Common exam trap
Candidates often confuse customization with configuration; customization modifies source code or adds custom objects, while configuration uses built-in parameters, and only customization significantly increases upgrade costs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Higher costs for future upgrades
Extensive customization of an ERP system typically involves modifying the core code or configuration beyond standard parameters. This creates a custom code base that diverges from the vendor's standard release, making future upgrades significantly more complex and costly because each upgrade requires re-applying and testing all customizations against the new version, often requiring specialized skills and extensive regression testing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increased vendor lock-in
Why it's wrong here
Vendor lock-in stems from proprietary extensions and platform dependence, not from customising the ERP's own configuration and code. Lock-in would be the correct risk when an organisation adopts vendor-specific cloud services or proprietary APIs that resist migration to another provider.
- ✗
Simpler data migration
Why it's wrong here
Customisation alters table structures and field mappings, so migration scripts must be rewritten and reconciled against bespoke schemas, increasing migration effort rather than simplifying it. The option is tempting because standardised, unmodified ERP modules with vendor-supplied templates genuinely streamline data migration — the correct choice when an organisation adopts vanilla configuration and adapts processes to the software.
- ✗
Reduced user acceptance
Why it's wrong here
Customisation usually aligns the ERP with familiar processes, which tends to aid acceptance rather than reduce it; resistance arises from poor change management. Reduced acceptance would be the expected risk when process re-engineering forces users away from established workflows without training.
- ✓
Higher costs for future upgrades
Why this is correct
Customisations modify core ERP code, so vendor-supplied patches and new releases no longer apply cleanly. Each future upgrade then requires rework, retesting and regression effort to reapply and reconcile the customisations, directly increasing upgrade cost.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.