4B2 - System Development and Maintenance. Questions from Review

Managing the information system function is likely to involve:

Managing the information system function includes all of the following management issues: charging user departments for computer services, project development planning (e.g., using Gantt charts), and responsibility accounting principles.

Change management and control procedures help to control information system changes. Which of the following is not an example of a change management control?

Studying the existing information system is a task typically assigned to a systems analyst in the operational and maintenance phase of the system development life cycle; it is not an example of change control. The remaining answer choices are valid examples of change management controls (use the strategic master plan to prioritize all change requests; develop a plan to back out of any unsuccessful mission-critical system change; and require IT management to review, monitor, and approve all change requests).

Which of the following large-scale conversion approaches to system implementation presents the greatest risk to an organization?

The conversion strategy with the greatest risk is the direct changeover (also called the "big bang"), which requires complete implementation to occur in one single instance. All legacy applications (if any) are ceased and all users move to the new system on an agreed-upon day. This strategy presents the greatest risk to an organization as the full transition occurring at a single point in time allows for few, if any, fallback plans should the conversion fail or contain errors. It is also difficult to conduct end-to-end testing prior to the conversion, increasing the risk of error.

The system development life cycle (SDLC) consists of five phases, with multiple steps in each phase. Which of the following is not the correct match of the step to its phase?

conceptual design phase: Development of detailed specifications that describe what the system should accomplish and how it will be controlled. communicate design requirements to the IT steering committee Systems analysis: conduct a system survey Operations and maintenance: periodically review the system

The online data entry control called preformatting is:

- the display of a document with blanks for data items to be entered by the terminal operator. Just as preprinted source documents can be used to control the data collection and data recording processes in a manual system, the flashing of an outline of a document on a video monitor can be used to control the data transcription process in a computerized system that utilizes online data entry. This technique is referred to as preformatting screens.

A number of factors should be considered when determining which IT conversion strategy to use (e.g., parallel versus phased approach). Which of the following is not one of those factors?

Factors to consider when choosing an implementation strategy include the size and complexity of the organization, the organization's risk appetite, existing software architecture, anticipated benefits of the conversion, the impact on personnel, and budgetary and time constraints. Marketing implications are not a critical factor.

The fixed assets and related depreciation of a company are currently tracked on a password-protected spreadsheet. The information technology governance committee is designing a new enterprise-wide system and needs to determine whether the current fixed asset process should be included because the current system seems to be working properly. What long-term solution should the committee recommend?

- An enterprise-wide system is intended to include financial records of the entire entity, so the depreciation records should become part of the new system. Enterprise resource planning (ERP) systems integrate all aspects of a company's operations with its traditional information system.

Which of the following information technology (IT) departmental responsibilities should be delegated to separate individuals?

- Data entry and application programming If the same person did data entry and application programming, fraudulent data could be entered into the system and the application program could be structured to defeat controls that would detect the fraud. Combining control over wireless access and network maintenance, data entry and antivirus management, or data entry and quality assurance does not present an opportunity for theft of assets.

Misstatements in a batch computer system caused by incorrect programs or data may not be detected immediately because:

- Batch processing is updating master files periodically to reflect all transactions that occurred during a given time period. To do this, transactions are grouped in batches and processed as a batch, leading to time delays before a batch is processed. "Errors in some transactions may cause rejection of other transactions in the batch" is incorrect because rejection of one transaction does not necessarily impact other transactions. "The identification of errors in input data typically is not part of the program" is incorrect because batch systems typically have routines to check input data for specific types of errors such as incorrect part numbers or account numbers. "The processing of transactions in a batch system is not uniform" is incorrect because batch systems typically process all transactions in the same uniform manner.

Which of the following items would be most critical to include in a systems specification document for a financial report?

- Data elements needed Before considering the cost, training, or communications changes, you must specify the data elements in the report on which the report will be based. Data elements needed, training requirements, and communication change management considerations all follow once the elements are determined. They are important steps to consider in a system design, but are not part of the systems specification document that identifies the features of a proposed system. Cost-benefit analysis is the pervasive constraint that the benefits of the information must exceed the cost of acquiring and presenting the information.

In which of the following phases of computer system development would training occur?

- Implementation phase Implementation is the process of installing a computer system. It includes selecting and installing the equipment, training personnel, establishing operating policies, and getting the software onto the system and functioning properly.

In an accounting information system, which of the following types of computer files most likely would be a master file?

- Inventory subsidiary (BS accounts are master files) A master file is used in electronic data processing and contains relatively permanent information used for reference and updated periodically. An inventory file lists the inventory on hand at a point in time. It is an asset, a balance sheet account. Cash disbursements, cash receipts, and payroll transactions are incorrect answer choices because they are temporary transaction files that are combined with other transactions to appear in income statement accounts. Temporary accounts are closed to zero at the end of the period, unlike balance sheet accounts that are carried over to the next period.

A company is considering a move to a software as a service (SaaS) offering instead of a traditional in-house application. Which of the following concerns is unique to SaaS?

- Ownership of processed data and costs of data migrations Software as a service (SaaS) is a method for delivering software applications over the internet, on demand and typically on a subscription basis. With SaaS, cloud providers host and manage both the software application and underlying infrastructure, and handle maintenance, like software upgrades and security patching. Users connect to the application over the internet, usually with a web browser on their phone, tablet, or PC. Cloud-based systems have several concerns that companies must cope with: (1) Given that the company does not physically control the storage and maintenance of its data, an entity's data can be compromised or lost if the cloud provider goes out of business or is acquired by another company. (2) The cost of migration and subscription fees for cloud-based CRM software can be more costly over time than on-premises models.

Which system conversion approach results in all users being migrated to the new system in a predetermined series of steps, either by module, business unit, or location?

- Phased approach Under the phased approach, the cutover and adoption of the new application occurs in phases over an extended period of time; all users are migrated to the new system in a predetermined series of steps. This can be by module, business unit, or location. With a parallel approach, the new system is run alongside the legacy system; users are trained on the new system while the old system is still operational. The "big bang" approach occurs in one single instance; all users move to the new system on an agreed-upon day. A pilot conversion is a software migration method that involves rolling out the new system to a small group of users for testing and evaluation, allowing the test group users to provide feedback on the system so that the eventual rollout to all users goes more smoothly; it is basically a two-step process.

A user noticed that the accounts receivable update program was not providing a listing of outstanding accounts. The user asked a programmer to modify the program so that the report would be generated with each run and had the request authorized by change management. The programmer obtained a copy of the program and made the required changes. She then tested the program in the test environment and was satisfied that it worked correctly. The programmer returned the program to the system librarian to return it to the production library. Which aspect of this process violated a proper segregation of duties?

- The system librarian accepted the program into the production library after it had been tested by the programmer. The system librarian should only accept a modified program that has been properly tested by someone independent of the programmer to make sure that no unauthorized changes have been made.

In the systems development cycle, coding is:

- part of the detailed design phase. The systems development cycle consists of analysis, conceptual design, detailed design, implementation, and operation. In this cycle, coding (of data, accounts, etc.) is a part of the detailed design stage, the stage in which programs and data structures are developed and facilities are installed and employees are trained.

The most appropriate data-gathering techniques for a system survey include interviews, quick questionnaires, observations, and:

- systems documentation. During the systems analysis phase, a system survey may be conducted to define the nature and scope of the project and to identify strengths and weaknesses. Information needs of users and managers are identified and documented through the use of interviews, quick questionnaires, observations, and systems documentation. In software development, a prototype is a rudimentary working model of a product or information system, usually built for demonstration purposes or as part of the development process. A Gantt chart is a type of bar chart that shows a complete project schedule, with start and finish dates. A PERT chart is another type of project management tool used to schedule, organize, and coordinate tasks within a project.

Which of the following is an advantage of a computer-based system for transaction processing over a manual system? A computer-based system:

- will be more efficient at producing financial statements. Computer processing is the performance of specific commands to data (e.g., retrieve, sort, calculate, summarize, compare) and is the step between input and storage and/or output. Once properly installed, computer processing results in faster preparation of financial statements than manual processing with considerably less human effort, so it is more efficient than manual processing. Manual processing is the preparation of accounting records without the use of computers. "A computer-based system does not require as stringent a set of internal controls" is incorrect because a properly designed computerized system includes many internal controls. "A computer-based system will produce a more accurate set of financial statements" is incorrect because both manual and computer-based systems can produce accurate financial statements. "A computer-based system eliminates the need to reconcile control accounts and subsidiary ledgers" is incorrect because reconciliation of control accounts and subsidiary ledgers is required in both types of systems to insure accuracy of the financial statements.

Very rarely will information systems meet all user requirements when initially implemented. As a result, systems development personnel may be tempted to make unauthorized changes to the software or system to meet user needs. To mitigate this risk, management should implement:

Change management control policies put into place the proper processes and approval channels to make changes to an organization's systems.

Change management control policies should contain which of the following elements?

Change management control policies put into place the proper processes and approval channels to make changes to an organization's systems. At a minimum, they should include the following elements: - Formalized channels for requesting and approving changes to any of the organization's information systems - Preventing unauthorized changes from occurring - Ensuring that any changes made do not impair or negatively impact the other functions of the system - Ensuring that the viability of the system as a whole is not impaired - Requiring appropriate testing of all changes before implementation to production environments occurs

Embedded audit modules:

Embedded audit modules enable continuous monitoring of transaction processing. - Identifying unexpected computer code is a characteristic of snapshot. - Aiding in debugging application systems is a characteristic of tracing. - Analyzing the efficiency of programming is a characteristic of mapping.

Many people play strategic roles in systems development. Which of the following roles is not correctly matched to one of its functions?

Correct: Top management: establish project selection priorities and set organizational policies. User management: allocate the funds needed to develop and operate the system. Information systems steering committee: coordinate information systems activities. Planning and providing oversight to the information systems function as a job for the information systems steering committee. This committee typically crosses function and divisional boundaries and is, therefore, best suited to coordinate all IT projects.

At what phase in the systems development process is a report generated that describes the content, processing flows, resource requirements, and procedures of a preliminary system design?

During conceptual design, the company identifies and evaluates appropriate design alternatives; develops detailed specifications that describe the content, processing flows, resource requirements, and procedures for the system; and communicates the conceptual design requirements to the information systems steering committee. During the physical design phase, the company uses the conceptual design requirements to design input and output documents, write computer programs, create files and databases, develop policies and procedures, and build controls into the new system.

The systems development life cycle (SDLC) consists of five distinct phases. Which of the following is not a component of the implementation and conversion phase?

During the implementation and conversion phase, all physical design components are assembled and the system is put into place. Modification of the system occurs in the operation and maintenance phase. All other choices listed occur in the implementation and conversion phase, as well as the following: - An implementation and conversion plan is created and implemented. - Hardware and software are installed and tested. - Employees are hired; all employees are trained. - Standards and controls are established and implemented. - System documentation is completed. - The organization converts to the new system and discontinues the old system. - Fine-tuning adjustments are made. - The steering committee is sent a final report.

An online database management system for sales and receivables was recently expanded to include credit approval transactions. An evaluation of controls was not performed prior to implementation. If certain data elements were not defined in the expansion, the following problem could result:

Failure to completely define the program specification blocks (PSB) prevents the application program from accessing or changing data, resulting in incomplete processing. - Data element definition allows application programs to access or change data; therefore, if they are not defined, no access takes place. - Without the program specification blocks, the application program cannot access data and cannot execute. - The desired manipulation of the database contents by an application program cannot take place if program specification blocks are not defined.

Which of the following describes infrastructure as a service (IaaS)?

Infrastructure as a service (IaaS) provides the basic building blocks for cloud IT and typically provides access to IT infrastructure assets—servers and virtual machines (VMs), storage, networks, operating systems—from a cloud provider who charges on a pay-as-you-go basis. Platform as a service (PaaS) refers to cloud computing services that supply an on-demand environment for developing, testing, delivering, and managing software applications, allowing developers to focus on creating and delivering those applications rather than worrying about resource procurement, capacity planning, software maintenance, or infrastructure management. Software as a service (SaaS) is a method for delivering software applications over the internet, on demand and typically on a subscription basis. With SaaS, cloud providers host and manage both the software application and underlying infrastructure, and handle maintenance, like software upgrades and security patching. Users connect to the application over the internet, usually with a web browser on their phone, tablet, or PC (personal computer).

When project development and acquisition controls are not used, there is a risk that development or acquisition projects will be poorly managed and waste large sums of money. Which of the following is not an example of a project development and acquisition control?

Post-implementation reviews (not pre-implementation reviews) are conducted to determine if the project's anticipated benefits were achieved, and to encourage accurate and objective initial cost and benefit estimates. The remaining answer choices (develop and use a strategic master plan, develop system performance measurements so the system can be properly evaluated, and assign each project to a manager and team and hold them responsible for the project's success or failure) are all examples of project development and acquisition controls.

The systems development life cycle (SDLC) consists of five distinct stages. Which of the following is the correct order of stages?

The correct order is systems analysis (gather information needed to develop the system); conceptual design (identify and evaluate appropriate design alternatives); physical design (design input and output documents, write the programs, create the files and databases); implementation and conversion (install and test hardware and software, hire and train employees); and maintenance (review and revise the system as needed).

Which system conversion approach is generally considered to be the least risky?

The parallel conversion approach is generally considered to be the least risky; it is completed at a slower pace than the "big bang" approach but faster than the phased rollout. It allows users to learn the new system while continuing to work in the legacy environment, and there is always a fallback available if the new system is unacceptable. The phased approach is slightly more risky, as the project duration is long, leading to the risk that employees lose focus and the need for urgency. The "big bang" approach is a bit like "sink or swim" and much faster. Small details and problems can be ignored or overlooked in the rush to convert. The direct changeover approach is another name for the "big bang" approach.