Certified Information Systems Auditor (CISA) Information Systems Acquisition, Development, and Implementation Syllabus

What is Net Present Value (NPV) and what decision rule applies?

NPV is the sum of discounted future cash flows minus the initial investment. Accept the project if NPV > 0 (it adds value); reject if NPV < 0.

What is the payback period in a cost-benefit analysis?

The length of time required for the cumulative net cash inflows of a project to recover the initial investment. Shorter payback is generally preferred but it ignores time value of money and post-payback returns.

What is Total Cost of Ownership (TCO) and why is it used in acquisition decisions?

The full lifecycle cost of a system including acquisition, implementation, training, operation, maintenance, and disposal. It gives a more realistic basis than purchase price alone for build-vs-buy comparisons.

In a build-vs-buy decision, what favors buying (acquiring) a commercial off-the-shelf package?

Faster implementation, lower upfront risk/cost, vendor-supported maintenance and upgrades, and proven functionality—best when requirements are common and not a competitive differentiator.

In a build-vs-buy decision, what favors building (in-house development)?

Unique/competitive-advantage requirements, the need for full control and customization, no suitable package exists, and integration or security needs that packages cannot meet.

What document is typically issued to vendors to obtain bids for an acquired system?

A Request for Proposal (RFP), which specifies requirements and evaluation criteria so vendors can submit comparable proposals for objective selection.

What is escrow of source code and why is it relevant when buying software?

A third party holds the vendor's source code; it is released to the buyer if the vendor fails (e.g., goes bankrupt or stops support), protecting the buyer's ability to maintain the acquired software.

List the traditional phases of the Systems Development Life Cycle (SDLC).

Feasibility, Requirements definition, Design, Development (build/coding), Testing, Implementation (deployment), and Post-implementation/Maintenance.

What is the key characteristic of the Waterfall SDLC model?

A linear, sequential approach where each phase must be completed and signed off before the next begins; well-suited to stable, well-understood requirements but inflexible to change.

What distinguishes Agile development from traditional Waterfall?

Agile is iterative and incremental, delivering working software in short cycles with continuous customer collaboration and the ability to adapt to changing requirements, rather than a single big-bang sequential delivery.

In Scrum, what is a sprint?

A short, fixed-length time-box (commonly 1-4 weeks) during which the team produces a potentially shippable product increment from items pulled out of the product backlog.

Name the three core roles in Scrum.

Product Owner (owns and prioritizes the backlog/business value), Scrum Master (facilitates the process and removes impediments), and the Development Team (builds the increment).

What is the product backlog in Scrum?

A prioritized, evolving list of all desired features, requirements, and changes for the product, owned and ordered by the Product Owner; sprint backlogs are drawn from it.

What is DevOps?

A set of practices and culture that integrate development and IT operations to deliver software faster and more reliably through automation, continuous integration/continuous delivery (CI/CD), and shared responsibility.

What control concern does DevOps/CI-CD raise for an IS auditor, and how is it addressed?

Rapid automated deployments can weaken segregation of duties and change approval. It is addressed by automated controls in the pipeline: automated testing, approval gates, version control, and immutable audit logs.

What is prototyping as a development approach?

Building a working model of the system iteratively with user feedback to refine requirements. It is good for unclear requirements but risks scope creep and weak documentation/controls if not managed.

What is Rapid Application Development (RAD)?

An approach emphasizing fast development through prototyping, iterative user involvement, and reusable components/tools to deliver systems quickly, trading some rigor and documentation for speed.

What is the main benefit and main risk of software reuse (e.g., components/libraries)?

Benefit: faster, lower-cost, more reliable development. Risk: inheriting vulnerabilities or licensing/compliance issues from reused components, requiring vetting and inventory control.

What are application controls?

Controls embedded within an application that ensure the completeness, accuracy, validity, and authorization of transactions and data—classified as input, processing, and output controls.

Give examples of input application controls.

Edit/validation checks, range checks, limit/reasonableness checks, check digits, sequence checks, completeness checks, and authorization controls to ensure data entered is accurate and valid.

What is the purpose of a check digit?

An input control: an extra digit computed from a number's other digits to detect transcription/transposition errors in key fields such as account or ID numbers.

Differentiate unit testing from integration testing.

Unit testing verifies individual components/modules in isolation; integration testing verifies that combined modules work correctly together and that interfaces between them function as intended.

What is system testing versus user acceptance testing (UAT)?

System testing validates the complete integrated system against technical specifications (usually by IT/QA). UAT validates that the system meets business requirements and is performed/approved by end users before go-live.

What is regression testing and when is it performed?

Retesting previously working functionality after changes or fixes to ensure that the modifications have not introduced new defects or broken existing features.

Differentiate black-box from white-box testing.

Black-box testing checks functionality against requirements without knowledge of internal code/logic; white-box (structural) testing examines internal code paths, logic, and structure.

What is the difference between alpha testing and beta testing?

Alpha testing is conducted in-house by the developer/organization before release; beta testing is conducted by selected real users in their own environment prior to general release.

What is the purpose of change management (change control) in development?

To ensure that all changes to systems are requested, assessed for impact, approved, tested, documented, and authorized before being moved to production, preventing unauthorized or destabilizing changes.

What is configuration management (CM) and what is a configuration item?

CM is the process of identifying, controlling, and tracking versions of system components (configuration items) and their relationships, ensuring a known, consistent, and auditable baseline of the system.

Why is version control essential in software development?

It tracks all changes to source code, supports concurrent work, enables rollback to prior versions, provides an audit trail of who changed what and when, and prevents unauthorized or lost changes.

What is the role of Quality Assurance (QA) versus Quality Control (QC) in development?

QA is process-oriented and preventive—ensuring development processes/standards are followed to prevent defects. QC is product-oriented and detective—testing/inspecting deliverables to find defects.

What is a code review (peer review) and what control benefit does it provide?

Systematic examination of source code by developers other than the author to find defects, security flaws, and standards violations early; it also enforces segregation of duties and reduces single-person risk.

Why should test data and production data be kept separate, and what control applies to using production data in testing?

To protect data integrity and confidentiality. If production data is used for testing, it should be sanitized/masked (de-identified) to protect sensitive information and comply with privacy requirements.

Why must the test environment be separate from the production environment?

To prevent testing activities from corrupting live data or disrupting operations, to enforce segregation of duties between development/testing and production, and to allow controlled, repeatable testing.

What is go-live (deployment) readiness assessment?

A pre-implementation check confirming that testing is complete and signed off, data is migrated, users are trained, fallback/rollback plans exist, support is ready, and required approvals are obtained before moving to production.

Compare the parallel and direct (big-bang) changeover (cutover) strategies.

Parallel runs old and new systems simultaneously until the new is proven (safe but costly/resource-intensive). Direct/big-bang switches off the old and on the new at once (cheap/fast but highest risk—no fallback).

What is a phased changeover approach?

Implementing the new system in stages (by module, location, or function) rather than all at once, which limits risk to a portion of the system but lengthens the transition and requires interim interfaces.

What is a pilot changeover strategy?

Deploying the new system to one site or user group first to validate it under real conditions before rolling it out organization-wide, limiting exposure if problems occur.

What controls ensure data integrity during data migration/conversion?

Record counts and control totals, hash/checksum reconciliation, field-by-field validation, before-and-after balancing, exception reporting, and sign-off that source and target data match completely and accurately.

Why is reconciliation a key control in data conversion?

To verify that all records were converted completely and accurately—comparing record counts and control/value totals between the legacy source and the new target so no data is lost, duplicated, or altered.

What is the purpose of a post-implementation review (PIR)?

Conducted after the system has stabilized to assess whether the project met its objectives, delivered expected benefits/ROI, and to capture lessons learned for future projects.

When should a post-implementation review typically be conducted?

After the system has been in production long enough to stabilize and demonstrate real benefits (commonly a few months post go-live), but soon enough that lessons learned and benefit data remain accurate.

What is system acceptance and sign-off, and who should provide it?

Formal confirmation that the delivered system meets agreed requirements and acceptance criteria. It should be approved by the system owner/business users (and sponsor), based on successful UAT, before final go-live.

What are acceptance criteria in the context of system acceptance testing?

Predefined, measurable conditions that the system must satisfy for users to accept it; they form the objective basis for UAT and the sign-off decision.

What is the IS auditor's main concern when reviewing UAT results before go-live?

That UAT was performed by appropriate end users, covered all critical requirements, that defects were resolved or formally accepted, and that documented sign-off exists before the system moves to production.

What is a fallback (rollback/back-out) plan in deployment?

A predefined procedure to restore the previous system/state if the new implementation fails, ensuring business continuity; its existence is a key go-live readiness control.

What is scope creep and how is it controlled?

Uncontrolled expansion of project scope without corresponding adjustments to time, cost, and resources. It is controlled through formal change/scope management, baselined requirements, and a requirements traceability matrix.

What is a Work Breakdown Structure (WBS)?

A hierarchical decomposition of the total project work into smaller, manageable deliverables and work packages, used as the basis for estimating, scheduling, assigning, and controlling work.

What is function point analysis used for?

A method to estimate software size and effort based on the functionality delivered to the user (inputs, outputs, inquiries, files, interfaces), independent of the technology or programming language used.

What is the key risk of inadequate user involvement during requirements definition?

The delivered system may not meet actual business needs, leading to rework, low adoption, scope changes, and benefit shortfalls—making early and continuous user participation a critical success factor.

What is a quality gate (stage gate) in a project lifecycle?

A predefined decision point between phases where deliverables and criteria are reviewed and formally approved before the project is allowed to proceed, enforcing control and accountability.

What risk does emergency change handling pose, and what compensating control applies?

Emergency changes may bypass normal approval/testing, risking instability or unauthorized changes. Compensating control: documented emergency procedures with after-the-fact review, approval, and full logging/reconciliation of what was changed.