An IS auditor finds that user acceptance testing of a new system is being repeatedly interrupted as defect fixes
are implemented by developers. Which of the following would be the BEST recommendation for an IS auditor to
make?

A.
Consider feasibility of a separate user acceptance environment

B.
Schedule user testing to occur at a given time each day

C.
implement a source code version control tool

D.
Only retest high priority defects

Explanation:
A separate environment or environments is normally necessary for testing to be efficient and effective, and to
ensure the integrity of production code, it is important that the development and testing code base be separate.
When defects are identified they can be fixed in the development environment, without interrupting testing,
before being migrated in a controlled manner to the test environment. A separate test environment can also be
used as the final staging area from which code is migrated to production. This enforces a separation between
development and production code. The logistics of setting up and refreshing customized test data is easier if a
separate environment is maintained. If developers and testers are sharing the same environment, they have to
work effectively at separate times of the day. It is unlikely that this would provide optimum productivity. Use of a
source code control tool is a good practice, but it does not properly mitigate the lack of an appropriate testing
environment. Even low priority fixes run the risk of introducing unintended results when combined with the rest
of the system code. To prevent this, regular regression testing covering all code changes should occur. A
separate test environment makes the logistics of regression testing easier to manage.