ITPEC FE Morning April 2021 Question 59

The user department takes part in reviewing the system design — that control catches requirements that were missed or misread before they are built.

The risk named is that the finished system will not meet the users' requirements. In the system design stage the requirements are turned into design documents, so the control an auditor looks for is that the people who stated the requirements check those documents. When the user department joins the design review, gaps are found while they are still cheap to fix.

Answer (d)

Why not others:

• •(a) — following programming standards and conventions is a control of the programming phase; it protects code quality, not the fit to requirements
• •(b) — deriving program specifications from the design documents keeps programs consistent with the design, but cannot detect a design that misses the users' needs
• •(c) — a test plan approved by the system operations department belongs to the test phase, and it involves operations rather than the users

Key rule: Match an audit checkpoint to both the phase and the risk: a risk about user requirements is controlled by user participation in the reviews of that phase.

System Audit · AI-written, may contain errors