Which of the following is the MOST important consideration when integrating a new vendor with an enterprise resource planning (ERP) system?

Integrating a new vendor with an Enterprise Resource Planning (ERP) system introduces significant risks to the organization's core data and business processes. A vendor risk assessment is the most critical initial step as it evaluates the vendor's security posture, financial stability, operational capabilities, and compliance with legal and regulatory requirements. This foundational activity provides the necessary information for senior management to make an informed selection, for procurement to draft an appropriate contract with necessary safeguards, and for technical teams to plan a secure integration. Without a thorough risk assessment, the enterprise is exposed to potential data breaches, operational disruptions, and non-compliance, making this the paramount consideration for governance of enterprise IT (GEIT).

A. IT senior management's role is strategic approval and oversight, but the selection itself should be based on a formal evaluation process, of which risk assessment is a primary component.
C. ERP data mapping is a crucial technical task during the implementation phase, but it occurs after the strategic decision to engage the vendor has been made based on risk and business value.
D. The contract's terms are essential for legal and operational control, but these terms are directly informed by the findings of the risk assessment, which identifies what needs to be contractually mandated.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 4: Risk Optimization, Task Statement T4.5, states the need to "Ensure the identification, analysis and evaluation of IT risk to determine the impact on business objectives." Integrating a new vendor into an ERP is a significant IT risk that must be evaluated first.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. The management objective APO10 Managed Vendors includes key practice APO10.02, "Identify and evaluate vendor relationships and contracts." A key activity listed is to "Periodically review and assess the risk of all vendors... Assess the risk associated with vendors not performing as expected..." This highlights risk assessment as a core activity in vendor management.

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives. The management objective APO10.03 Select vendors specifies that vendors should be selected based on requirements that "include the ability to meet security and privacy requirements." This ability is verified through a risk assessment process before selection and integration.