Which of the following controls is MOST effective at preventing system failures when implementing a new web application?

System testing is the most effective preventive control among the choices for averting system failures during the implementation of a new web application. This phase of the system development life cycle (SDLC) is specifically designed to identify and rectify defects, configuration errors, and performance issues before the application is deployed to a live production environment. By rigorously evaluating the system against predefined requirements under controlled conditions, testing directly reduces the likelihood of unexpected failures that could impact business operations, data integrity, and system availability upon go-live.

A. A system recovery plan is a corrective control, which is enacted to restore system functionality after a failure has already occurred, not to prevent it.

C. A business continuity plan (BCP) is a broad, strategic plan for maintaining essential business functions during a major disruption; it is not a specific technical control to prevent an individual application's failure.

D. Transaction monitoring is a detective control used in a live environment to identify anomalies or errors as they happen, rather than preventing the underlying cause of the failure.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.4.6

"Testing." The manual describes testing as a critical process to "ensure that the individual components of the system work correctly and are well integrated

" and its primary objective is to find and correct errors before the system is placed into production

thereby preventing failures.

2. ISACA

Auditing Application Controls

3rd Edition (2018). Chapter 2: "Auditing Controls in the Systems Development Life Cycle

" page 27. This guide emphasizes that the testing phase is a key control point to "provide assurance that the application will function as expected and will not introduce errors or vulnerabilities into the production environment." This directly supports testing as a preventive measure against implementation failures.

3. Weber

R. (2012). Information Systems Control and Audit. Pearson. Chapter 17

"Auditing Systems Development

" Section on "Testing Controls." This academic text

widely used in IT audit curricula

explains that the purpose of system testing is to uncover errors and weaknesses in a system before it is implemented. It frames comprehensive testing as the most important control for preventing costly post-implementation failures.