Exam CISA topic 1 question 780 discussion

Option B as it reffers to business continuity risk: If the vendor goes bankrupt or stops support, the organization loses access to source code (needed for maintenance/updates) and documentation (required for troubleshooting). There is no option to fallback as well. Escrow prevents existential threats.

Option B, "Software escrow was not negotiated," is indeed a significant concern for an IS auditor reviewing contracts for licensed software that executes a critical business process. Software escrow is essential because it ensures that the organization can access the source code and other critical materials necessary to maintain and support the software in case the vendor goes bankrupt or fails to fulfill its obligations.

I think Escrow is the right answer. Question is related to "Software" license contract for a critical process. Right to audit may be the right answer for outsourced services..

A right-to-audit clause allows the organization to conduct audits of the software vendor's performance, including verifying compliance with licensing terms, security standards, and service level agreements. For software that executes critical business processes, ensuring compliance with licensing terms and the reliability of the software is paramount. Without a right-to-audit clause, the organization may lack the ability to verify the vendor's performance, potentially exposing it to risks such as non-compliance, security vulnerabilities, or service disruptions. While software escrow (option B) is also important for mitigating risks associated with vendor non-performance, the absence of a right-to-audit clause presents a more significant concern as it directly impacts the organization's ability to verify and enforce contractual obligations and ensure the integrity of critical business processes.

Answer C In the context of reviewing contracts for licensed software, the primary concern is often ensuring that the organization has the necessary rights and mechanisms to monitor and enforce compliance with the terms of the software license agreement. This includes verifying that the organization has the right to audit the vendor's compliance with the terms of the contract, which is typically addressed through a right-to-audit clause.

C. The contract does not contain a right-to-audit clause.