CISA Information Systems Acquisition practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

CISA Information Systems Acquisition, Development and Implementation: 348 practice questions

CISA 348 questions 12 shown free

12 of the 348 Information Systems Acquisition, Development and Implementation questions in the Certsqill CISA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISA? Take the free 5-min readiness check →

1. Approved steering minutes record scope: Which evidence is BEST?

Medium
A regional bank audit examines project governance for a core banking upgrade. The auditor must select the strongest evidence that the project’s major scope, cost, and risk decision was authorized. Which evidence is BEST?
  1. Approved steering minutes record scope, cost, risk, and sponsor authorization. ✓
    Approved minutes directly evidence governance review and authorization.
  2. A developer’s meeting notes describe the preferred design and expected implementation schedule.
    Developer notes lack evidence of sponsor or steering authorization.
  3. A project manager’s spreadsheet lists estimated costs and current milestones.
    The spreadsheet shows information but not authorized governance decisions.
  4. An email from the vendor confirms that configuration work has started.
    Vendor activity does not demonstrate internal authorization of major changes.
The trap
Uses supplier activity as governance evidence. Confuses project tracking with approval evidence. Confuses technical preference with governance approval.

Approved steering minutes directly document authorization of major project decisions.

2. Require a complete business case before approval: Which gap is MOST consequential?

Hard
A healthcare network’s exhibit shows a proposed patient-portal business case was approved using the cheapest vendor. Technical testing passed, but the case omits operational feasibility, alternatives, quantified benefits, and documented implementation risks. Which gap is MOST consequential?
  1. Request updated cost estimates and implementation dates before reconsidering approval.
    Additional estimates leave alternatives, benefits, feasibility, and implementation risks unresolved.
  2. Require a complete business case before approval. ✓
    Approval lacks alternatives, operational feasibility, risks, and measurable benefits needed for informed authorization.
  3. Approve because technical feasibility and the cheapest vendor were demonstrated.
    Technical feasibility and price alone cannot establish value, practicality, or acceptable implementation risk.
  4. Require more vendor references and technical demonstrations before proceeding with approval.
    References and demonstrations do not replace missing business-case decision criteria.
The trap
Treats price and testing as sufficient Focuses narrowly on cost and schedule Substitutes vendor diligence for completeness

Approval requires alternatives, feasibility, risks, and measurable benefits, not merely technical success.

3. Trace high-risk requirements through testing: What should the auditor do NEXT?

Hard
A public agency audit already reviewed the agile backlog, sampled requirements, and inspected security-test results. High-risk stories lack explicit acceptance criteria, while technical testing is documented. What should the auditor do NEXT?
  1. Repeat unit-test sampling.
    Repeating technical testing does not address missing business acceptance evidence.
  2. Compare sprint velocity with the project baseline and investigate variances.
    Velocity does not demonstrate requirements coverage or authorized business acceptance.
  3. Trace high-risk requirements through testing and acceptance. ✓
    Traceability through authorized acceptance addresses the identified agile control gap.
  4. Review the deployment calendar, budget status, and planned release milestones.
    Scheduling and budget evidence does not resolve high-risk acceptance uncertainty.
The trap
Repeats completed technical work Uses delivery metrics instead of control evidence Moves toward peripheral project information

The next procedure should test traceability from high-risk requirements through authorized acceptance.

4. Separate payment preparation from approval before: What response is MOST appropriate?

Easy
An energy supplier’s new payment system lacks a defined segregation requirement: one employee could prepare and approve a payment. Management proposes adding a review after deployment. What response is MOST appropriate?
  1. Accept the proposal because postdeployment review detects unusual payments.
    Detection after deployment does not prevent incompatible payment authority.
  2. Separate payment preparation from approval before development. ✓
    Segregation should be defined and embedded before implementation begins.
  3. Ask developers to decide whether segregation is technically convenient.
    Control requirements belong to accountable management, not developer preference.
  4. Recommend documenting the control after deployment once actual workflows become clearer.
    Deferring requirements increases redesign and control failure risk.
The trap
Substitutes detective review for preventive design. Delays essential control design unnecessarily. Delegates risk decisions to implementers.

Management should define segregated preparation and approval before system development.

5. Report that readiness and authorized acceptance remain: What is the auditor’s BEST conclusion?

Easy
A telecommunications company completed technical, integration, and security testing for a billing release. UAT passed 98 percent of cases, but one critical billing defect remains open and the authorized business owner has not accepted the release. What is the auditor’s BEST conclusion?
  1. Report that readiness and authorized acceptance remain unsupported ✓
    The critical defect and absent owner decision leave release readiness unsupported.
  2. Document the test completion rate and proceed
    Documentation cannot replace defect resolution or authorized business acceptance.
  3. Recommend conditional deployment while operations manage the defect after production
    Deployment would shift unresolved critical risk without authorized business acceptance.
  4. Declare readiness because most tests passed
    A high pass rate does not overcome a remaining critical defect.
The trap
Treats aggregate success as readiness Confuses reporting with authorization Assumes operations can replace business authorization

A critical defect and missing business-owner acceptance prevent a readiness conclusion.

6. Design is adequate: What conclusion is BEST?

Medium
A research organization’s release procedure requires authorization, testing, and segregation. The auditor confirmed the procedure is approved, then sampled twelve production releases: three lacked recorded authorization and one lacked documented testing. What conclusion is BEST?
  1. The releases are effective because most sampled releases complied with requirements.
    Missing authorization and testing records demonstrate operating failures despite majority compliance.
  2. Design is adequate; operation is unsupported by sampled exceptions. ✓
    The requirements are present, but exceptions undermine evidence of operating effectiveness.
  3. Approval proves the procedure is effective.
    Approval demonstrates design evidence, not consistent operation across sampled releases.
  4. The procedure is ineffective by design because sampled releases lacked required evidence.
    The approved procedure contains appropriate requirements despite operating-performance exceptions.
The trap
Relies on design evidence alone Confuses operation with design Treats partial compliance as full effectiveness

Design is present, but sampled exceptions undermine operating effectiveness evidence.

7. Delay cutover until rejected and inaccurate records are: Which recommendation is most appropriate?

Medium
During a distribution-center migration, 2.4 million source records matched target counts, but 18,000 records were rejected. Sampling also found incorrect warehouse codes, and cutover is scheduled tomorrow. Which recommendation is most appropriate?
  1. Reconcile rejected records, then document migration results without validating accepted values.
    Reconciliation alone does not address inaccurate values already accepted.
  2. Proceed while monitoring rejected records after cutover.
    Post-cutover monitoring leaves known conversion errors affecting operations.
  3. Proceed because source and target record counts agree.
    Matching counts do not demonstrate accurate values or complete conversion.
  4. Delay cutover until rejected and inaccurate records are corrected and retested. ✓
    Known completeness and accuracy failures prevent reliable migration assurance before cutover.
The trap
Accepts known defects prematurely. Overlooks inaccurate converted values. Treats completeness as sufficient evidence.

Delay cutover until completeness, accuracy, reconciliation, and retesting support migration reliability.

8. Expand review to objectives: What should the auditor recommend to improve assurance scope?

Medium
A transport operator stabilized a scheduling system three months after implementation. The review examined installation records and uptime, but not business objectives, realized benefits, controls, user outcomes, or lessons learned. What should the auditor recommend to improve assurance scope?
  1. Conclude implementation success from uptime alone.
    Uptime alone does not demonstrate objectives, benefits, or control effectiveness.
  2. Repeat installation testing before reviewing business outcomes and operational lessons.
    Repeating installation tests does not address omitted business assurance areas.
  3. Expand review to objectives, benefits, controls, outcomes, and lessons learned. ✓
    A post-implementation review should assess stabilized results beyond technical installation.
  4. Delay benefits and control review until the next year.
    Stabilization already permits timely evaluation of objectives and operational results.
The trap
Confuses availability with success. Unnecessarily delays assurance. Keeps assurance narrowly technical.

Expand post-implementation assurance beyond installation and uptime to business outcomes and controls.

9. Significant scope: Which project-governance gap is most consequential?

Medium
A software provider’s steering committee approved project scope and budget. Later, a project manager authorized a major scope increase and related risk without steering review. Which project-governance gap is most consequential?
  1. The project should have used a different development methodology.
    Methodology choice does not cure unauthorized scope and risk decisions.
  2. The steering committee should review every routine task before continuation.
    Governance oversight should target significant changes, not routine project activity.
  3. Significant scope, cost, and risk changes lacked required governance authorization. ✓
    Governance must assign decision rights for material changes affecting project exposure.
  4. The project manager lacked technical expertise.
    Technical expertise does not determine authority for significant project changes.
The trap
Creates excessive approval overhead. Substitutes methodology for governance. Focuses on capability instead of authority.

Material scope and risk changes require governance authorization, not unilateral project-manager approval.

10. Verify operational feasibility assessment and sponsor: What should the auditor do next?

Medium
An online marketplace’s sponsor approved a business case containing costs, benefits, alternatives, and risks. Technical and economic feasibility were documented, but operational impact was not assessed. What should the auditor do next?
  1. Verify operational feasibility assessment and sponsor approval. ✓
    Operational feasibility remains an unaddressed decision basis requiring evidence.
  2. Recalculate acquisition costs using an independent financial model.
    Costs were already addressed; the missing feasibility dimension remains operational impact.
  3. Recommend selecting the lowest-cost alternative immediately.
    Business cases compare benefits, risks, alternatives, and outcomes, not merely cost.
  4. Test postimplementation benefits before feasibility assessment is complete.
    Benefits testing is premature while operational feasibility remains unevaluated.
The trap
Repeats completed economic analysis. Treats cheapest as automatically best. Jumps ahead of an unresolved prerequisite.

Verify the missing operational feasibility assessment and its authorized business acceptance.

11. Require traceable requirements: How should the auditor evaluate management’s proposed response?

Easy
An investment firm proposes omitting formal requirements traceability and business acceptance because its project uses agile sprints. The response states that sprint demonstrations replace all formal control evidence. How should the auditor evaluate management’s proposed response?
  1. Accept sprint demonstrations when developers confirm completion without business authorization.
    Developer confirmation does not replace authorized business acceptance or traceability.
  2. Accept the response because agile projects need no formal controls or acceptance.
    Agile delivery still requires traceable requirements, testing, and acceptance evidence.
  3. Require waterfall documentation before any agile development continues.
    Agile is acceptable when necessary requirements and controls remain traceable.
  4. Require traceable requirements, security, testing, and authorized acceptance in agile delivery. ✓
    Methodology does not remove essential governance, control, testing, or acceptance requirements.
The trap
Confuses controls with one methodology. Substitutes technical confirmation for business ownership. Treats agile as control-free.

Agile may vary delivery practices but cannot eliminate traceability, testing, security, or acceptance.

12. The control operated ineffectively during the tested: How should the auditor interpret these results?

Medium
A payment processor requires transaction authorization and daily reconciliation. Audit testing found authorization evidence for all 40 sampled transactions, but reconciliation was not performed for three sampled days. How should the auditor interpret these results?
  1. The control is effective because all sampled transactions were authorized.
    Authorization does not compensate for omitted reconciliation procedures.
  2. The control design is invalid because authorization was tested.
    Testing authorization does not indicate that the control design itself is invalid.
  3. The control operated ineffectively during the tested period. ✓
    Missing required reconciliation demonstrates an operating failure despite authorization evidence.
  4. The control is effective because three missed days are immaterial without losses.
    Observed nonperformance requires evaluation; absence of losses does not prove operation.
The trap
Confuses operating failure with design failure. Uses outcome absence to excuse failure. Overlooks a separate control requirement.

Authorization passed, but missed reconciliation demonstrates ineffective operation during tested days.

336 more Information Systems Acquisition, Development and Implementation questions

The remaining 336 questions in this domain are part of the full CISA bank — 2900 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your CISA readiness — free

Other CISA domains

Part of the Certsqill CISA question bank · Information Systems Acquisition, Development and Implementation · Every answer, right and wrong, comes with its own explanation.