CISA domain - 12% of the exam

Information Systems Acquisition, Development and Implementation

Information Systems Acquisition, Development and Implementation is 12% of the Certified Information Systems Auditor (CISA) (CISA) exam. These are the objectives it covers, each with practice questions and worked explanations.

Objectives in this domain

Sample question from this domain

Free sampleInformation Systems Acquisition, Development and Implementationmedium

Which statement BEST describes the primary purpose of a business case at the outset of a systems acquisition project?

  • ATo document the detailed functional and non-functional requirements that the chosen vendor must satisfy before contract award.
  • BTo justify the proposed investment by linking expected benefits, costs and risks to a defined business problem and strategy. Correct
  • CTo record the agreed acceptance criteria that the steering committee will use to sign off the system at go-live.
  • DTo list the project deliverables, milestones and resource assignments that the project manager will track in the schedule.
Recognise that a business case justifies an investment by linking expected benefits, costs and risks to a defined business problem and strategy. Investment governance requires a documented case that ties forecast benefits, whole-of-life costs and risk exposure to a strategic objective; without that linkage the steering body cannot decide whether the proposed system is worth funding relative to alternatives.

Why A is wrong: Detailed functional and non-functional requirements belong in the requirements specification produced after the business case is approved, so this confuses two separate deliverables.

Why B is correct: A business case exists to demonstrate that an investment is justified by linking forecast benefits, whole-of-life costs, risks and strategic fit, which is the basis on which governance bodies authorise funding.

Why C is wrong: Acceptance criteria are part of the user acceptance testing approach near the end of the project, not the early justification artefact reviewed by the investment board.

Why D is wrong: Deliverables, milestones and resource assignments are scheduling outputs that follow approval of the business case rather than the justification it provides.

Other domains in this exam

See also the CISA cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.