At what point during the systems development process should an internal auditor verify that the new application's connectivity to the organization's other systems has been established correctly?

The most appropriate time for an internal auditor to verify that a new application's connectivity has been correctly established is during the testing phase of the Systems Development Life Cycle (SDLC). This phase includes integration testing and system testing, which are specifically designed to ensure that the new application interfaces and communicates correctly with other existing systems. Verifying connectivity at this stage allows for the identification and remediation of issues before the system is deployed into a live production environment, thereby minimizing risk, cost, and operational disruption.

A. Prior to testing, connectivity exists only as a design. The actual connections have not been built or configured, making it impossible to verify their correct establishment.
C. Verifying during implementation is too late. Discovering fundamental connectivity failures at the point of "go-live" would be highly disruptive and costly to fix, likely causing project delays.
D. The maintenance phase occurs after the system is already operational. Initial verification of core functionality like connectivity must be completed before the application is put into production use.

1. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 8: Auditing Application Controls

2nd Edition

2012. Section 3.4

"Testing Phase

" states: "Integration testing verifies that the application works with other applications as planned... The internal auditor should review the adequacy of the testing process." This confirms that verifying inter-system connectivity is a key activity of the testing phase.

2. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 1: Information Technology Risk and Controls

2nd Edition

2012. The guide outlines the auditor's role across the SDLC. In the section "The System Development Life Cycle" (page 21)

it specifies that during the "Development/Acquisition and Implementation Phases

" the auditor should "monitor the system testing process

" which includes ensuring interfaces with other systems are functioning correctly.

3. Hall

J. A. (2018). Information Technology Auditing (5th ed.). Cengage Learning. Chapter 16

"The Systems Development Process

" details the auditor's objectives in the SDLC. It specifies that during the system testing phase

a key audit objective is to "verify that the application is functioning properly and is ready for implementation

" which includes testing interfaces with other systems.