CISA - Information Systems Acquisition, Development and Implementation (12% of the exam) - Section 3.1

Evaluate project governance and management, business case and feasibility analysis for systems acquisition and development.

Describe the elements of project governance and project management that ensure IS acquisition and development work stays within scope, schedule and budget. Evaluate a business case and feasibility analysis to determine whether the proposed investment is justified and risks are understood.

project governanceproject managementbusiness casefeasibility analysis

Practice question for this objective

Free sampleInformation Systems Acquisition, Development and Implementationmedium

Which statement MOST accurately distinguishes project governance from project management for a systems acquisition initiative?

AProject governance assigns daily task ownership while project management ratifies the investment decision at each phase gate.
BProject governance is exercised by the project sponsor alone while project management is exercised by the project management office function.
CProject governance sets the decision framework and accountability for outcomes while project management plans, executes and controls the work within it. Correct
DProject governance defines the technical architecture while project management negotiates the supplier contracts that deliver that architecture.

Differentiate project governance, which sets oversight and decision rights, from project management, which plans and controls the work within that frame. Governance bodies own the decision rights, accountability and risk appetite for the investment, while project management operates within that frame to plan, execute and control delivery, and confusing the two leads to either rubber-stamp oversight or unmanaged scope drift.

Why A is wrong: This inverts the two roles, since daily task ownership sits with the project manager and phase-gate ratification sits with the governance body.

Why B is wrong: Governance is a multi-stakeholder oversight structure rather than a single sponsor, and project management is exercised by the project manager, not by the office that supports them.

Why C is correct: Governance establishes the decision rights, oversight and accountability structures within which a delegated project manager plans, executes and controls the project work, which is the distinction set out in ISACA guidance and PMBOK.

Why D is wrong: Technical architecture decisions and supplier negotiations are project execution activities, not the oversight and decision-rights framing that defines governance.

See more CISA practice questions, answers explained.

Exam traps in Information Systems Acquisition, Development and Implementation

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISA bank for this domain.

To document the detailed functional and non-functional requirements that the chosen vendor must satisfy before contract award.
Why it is wrong: Detailed functional and non-functional requirements belong in the requirements specification produced after the business case is approved, so this confuses two separate deliverables.
Operational feasibility, which evaluates whether the organisation's people and processes can absorb the new way of working.
Why it is wrong: Operational feasibility looks at workforce readiness and process fit rather than the monetary return relative to the baseline scenario.
The qualitative benefits should have been excluded from the business case because they cannot be discounted to a present value alongside the cashable savings.
Why it is wrong: Mature business-case practice accepts qualitative benefits provided they are stated and tracked; excluding them would understate the case. The weakness is the absence of benefit ownership and measurement, not the inclusion of qualitative items, so this misses the PRIMARY issue.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.