CISA - Information Systems Acquisition, Development and Implementation - Section 3.1

Evaluate project governance and management, business case and feasibility analysis for systems acquisition and development.

Describe the elements of project governance and project management that ensure IS acquisition and development work stays within scope, schedule and budget. Evaluate a business case and feasibility analysis to determine whether the proposed investment is justified and risks are understood.

project governanceproject managementbusiness casefeasibility analysis

Practice question for this objective

Free sampleInformation Systems Acquisition, Development and Implementationmedium

Which statement MOST accurately distinguishes project governance from project management for a systems acquisition initiative?

  • AProject governance assigns daily task ownership while project management ratifies the investment decision at each phase gate.
  • BProject governance is exercised by the project sponsor alone while project management is exercised by the project management office function.
  • CProject governance sets the decision framework and accountability for outcomes while project management plans, executes and controls the work within it. Correct
  • DProject governance defines the technical architecture while project management negotiates the supplier contracts that deliver that architecture.
Differentiate project governance, which sets oversight and decision rights, from project management, which plans and controls the work within that frame. Governance bodies own the decision rights, accountability and risk appetite for the investment, while project management operates within that frame to plan, execute and control delivery, and confusing the two leads to either rubber-stamp oversight or unmanaged scope drift.

Why A is wrong: This inverts the two roles, since daily task ownership sits with the project manager and phase-gate ratification sits with the governance body.

Why B is wrong: Governance is a multi-stakeholder oversight structure rather than a single sponsor, and project management is exercised by the project manager, not by the office that supports them.

Why C is correct: Governance establishes the decision rights, oversight and accountability structures within which a delegated project manager plans, executes and controls the project work, which is the distinction set out in ISACA guidance and PMBOK.

Why D is wrong: Technical architecture decisions and supplier negotiations are project execution activities, not the oversight and decision-rights framing that defines governance.

See more CISA practice questions, answers explained.

More in this domain

Back to all Information Systems Acquisition, Development and Implementation objectives, or the CISA cert hub.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.