Which of the following should be of GREATEST concern to an |$ auditor reviewing data conversion and migration during the implementation of a…

The primary objective of an audit of data conversion and migration is to ensure the integrity, accuracy, and completeness of the data in the new system. Unauthorized data modifications represent a direct and confirmed compromise of data integrity. This is the most severe issue because it means the data in the new system is unreliable, potentially leading to incorrect business decisions, financial misstatements, and a loss of trust in the system's outputs. A realized impact on data integrity is always a greater concern than procedural weaknesses or potential recovery issues.

A. A lack of formal documentation is a significant process weakness, but it is a potential risk factor, not a confirmed negative outcome like data corruption.

B. Backups not being available online impacts the recovery time objective (RTO) but does not mean backups are nonexistent; they may be stored offline.

D. Manual processes increase the likelihood of error, but this is a risk factor, not a confirmation that unauthorized modifications or errors have actually occurred.

1. ISACA

CISA Review Manual

27th Edition. Domain 3: Information Systems Acquisition

Development

and Implementation

Section 3.4.5 Data Migration. The manual emphasizes that the key objective during data migration is to ensure that data is "accurate

complete and valid." Unauthorized modification (C) is a direct violation of this core objective

making it a greater concern than process control weaknesses (A

D) or recovery planning (B).

2. Weber

R. (2012). Information Systems Control and Audit. Pearson Education. Chapter 17

Auditing Computer Applications. The text discusses application controls and the audit of system implementations. It highlights that substantive testing

which would uncover actual data modifications

provides direct evidence of problems

whereas evaluating process documentation (A) or the nature of the process (D) are tests of controls that indicate potential risk. A confirmed data integrity issue is a substantive finding and thus of higher concern.

3. The University of Texas at Austin

McCombs School of Business. Courseware for MIS 373: IT Auditing and Security. In modules covering the System Development Life Cycle (SDLC) audit

a primary audit objective for the implementation phase is to verify the integrity of converted data. The course materials stress that evidence of data corruption or unauthorized changes is a critical finding that must be prioritized.