CISA System Development and Implementation 3 — Questions and Answers
Question 1: An IS auditor reviewing software procurement should FIRST verify that the vendor's product:
- Has the lowest licensing cost available
- Meets the organization's defined functional and security requirements (Correct answer)
- Is widely used by competitors in the same industry
- Supports the latest programming language standards
Correct answer: Meets the organization's defined functional and security requirements
Alignment with documented requirements is the foundational criterion before evaluating cost, market share, or technology features.
Question 2: Which of the following BEST describes the purpose of a program change log?
- To document developer time spent on each task
- To provide an audit trail of all modifications made to production programs (Correct answer)
- To track software licensing compliance
- To record user access requests to the system
Correct answer: To provide an audit trail of all modifications made to production programs
A program change log maintains a chronological record of who changed what and when, forming the audit trail for production program modifications.
Question 3: During a SDLC audit, an IS auditor notices that requirements sign-off was obtained from IT management only, excluding business users. This represents a weakness in:
- Project budgeting controls
- Requirements validation and stakeholder engagement (Correct answer)
- Technical architecture review
- Testing environment setup
Correct answer: Requirements validation and stakeholder engagement
Requirements must be approved by business stakeholders who will use the system, not just IT, to ensure the solution meets actual business needs.
Question 4: A software development team uses an iterative methodology where working software is delivered in short cycles. This BEST describes:
- Waterfall development
- Agile/Scrum development (Correct answer)
- Spiral model development
- Rapid application development (RAD)
Correct answer: Agile/Scrum development
Agile/Scrum delivers working software in short, time-boxed sprints with frequent stakeholder feedback and iterative refinement.
Question 5: When auditing a data conversion during system migration, the IS auditor should PRIMARILY verify that:
- The new system uses a modern database engine
- All data was accurately and completely transferred to the new system (Correct answer)
- The old system was decommissioned on schedule
- Data entry screens match legacy system layouts
Correct answer: All data was accurately and completely transferred to the new system
Data integrity and completeness during conversion is critical; any data loss or corruption directly impacts business continuity and reliability of the new system.
Question 6: An IS auditor finds that developers have direct access to the production environment. The MOST significant risk is:
- Increased help desk ticket volume
- Unauthorized or untested changes could be made directly to production (Correct answer)
- Slower deployment cycles due to access conflicts
- Developer productivity may decrease
Correct answer: Unauthorized or untested changes could be made directly to production
Direct developer access to production breaks segregation of duties and enables unauthorized modifications that bypass change control processes.
Question 7: In software project management, a critical path PRIMARILY helps an IS auditor assess:
- The total number of defects in the system
- Which tasks, if delayed, will directly extend the project completion date (Correct answer)
- The cost impact of scope changes
- Vendor performance against SLA metrics
Correct answer: Which tasks, if delayed, will directly extend the project completion date
The critical path identifies the sequence of dependent tasks with zero float, meaning any delay on these tasks delays the entire project.
CISA System Development and Implementation 3
An IS auditor reviewing software procurement should FIRST verify that the vendor's product: