Exam CISA topic 1 question 306 discussion

When reviewing a decision to change legacy system components while maintaining original functionality, it is most important for the IS auditor to understand the current business capabilities delivered by the legacy system. This is because any changes made to the system must ensure that those capabilities are preserved or improved. Understanding the business impact ensures that the new system will still meet the organization's operational and strategic needs.

The question already states that the functionality of the overall system will not change. Input / output remain the same. However, individual system components are replaced. So the biggest risk is the data flow between the replaced components. The auditor must therefore pay particular attention to this area. So D. is the right answer.

Answer: A Understanding the data flows between the components to be used by the redesigned system is indeed important, especially for ensuring data integrity, security, and proper functionality. However, when considering the decision to change components while maintaining functionality, the focus may initially be on assessing the business capabilities provided by the legacy system. This assessment helps determine whether the proposed changes align with the organization's current and future business needs. While understanding data flows is critical, it might not provide as comprehensive an understanding of the system's overall impact on business operations as understanding its business capabilities.

The MOST important aspect for an IS auditor to understand is the data flows between the components in the redesigned system. So, the answer is D

D. Data flows between the components

D. The data flows between the components to be used by the redesigned system

A. The current business capabilities delivered by the legacy system: This is the MOST important consideration for an IS auditor because it relates directly to the organization's overall business objectives. The auditor should evaluate whether the proposed changes align with the organization's current business capabilities, processes, and workflows. They should also consider whether the changes will affect the system's ability to deliver the intended business value.

D. The data flows between the components to be used by the redesigned system