User-Developed Applications (UDAs) are software tools, typically spreadsheets or small databases, created by business users rather than IT professionals. These applications often lack formal security, documentation, and control measures, increasing the risk of data errors, unauthorized access, and compliance failures.
UDAs are often created quickly to meet immediate business needs, without following IT governance, security controls, or development standards.
Unlike traditional IT applications, UDAs lack structured testing, change management, and formal documentation.
The IIA’s GTAG 14 – Auditing User-Developed Applications states that UDAs present higher risks because they are not subject to the same controls as IT-managed applications.
A. UDAs and traditional IT applications typically follow a similar development life cycle → Incorrect. Traditional IT applications follow a formal Software Development Life Cycle (SDLC), whereas UDAs are developed informally by end-users.
B. A UDA usually includes system documentation to illustrate its functions, and IT-developed applications typically do not require such documentation. → Incorrect. IT applications require extensive documentation, whereas UDAs often lack documentation entirely.
D. IT testing personnel usually review both types of applications thoroughly to ensure they were developed properly. → Incorrect. IT applications undergo rigorous testing and quality assurance, while UDAs often bypass IT reviews altogether.
IIA GTAG 14 – Auditing User-Developed Applications highlights the risks of UDAs and emphasizes the need for internal controls.
COBIT Framework (Control Objectives for Information and Related Technologies) recommends IT governance measures for all business-critical applications.
ISO 27001 (Information Security Management System) warns against uncontrolled user-developed applications due to security risks.
Why Option C is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is C. Unlike traditional IT applications, UDAs typically are developed with little consideration of controls.
