CISA Outsourcing software development Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The vendor's development methodology

  Why it's wrong here

  Methodology affects process quality but not the fundamental loss of control over code, data, and intellectual property inherent in outsourcing development. The auditor's primary concern is that exposure. Reviewing methodology is correct when assessing a vendor's engineering capability during selection, not the overarching outsourcing risk.

• ✓

  Protection of intellectual property and data

  Why this is correct

  Outsourcing transfers code and data to a third party, so the auditor's primary concern is safeguarding intellectual property and confidential data through contractual controls, access restrictions and monitoring, since loss or misuse directly threatens the organisation's assets and compliance obligations.

• ✗

  The vendor's financial stability

  Why it's wrong here

  Financial stability affects vendor viability, not the primary outsourcing risk: loss of control over code quality, intellectual property and change management. Auditors prioritise these because the company retains accountability. Vendor solvency is the correct focus when assessing long-term supplier continuity for a critical, single-sourced service.

• ✗

  Compliance with service level agreements

  Why it's wrong here

  SLA compliance addresses delivery performance, not the auditor's primary concern when source code and intellectual property leave the organisation. Outsourcing transfers control of code, data, and development practices to the vendor. SLA monitoring is the right focus for operational service delivery, such as uptime or response times.

Go deeper

Related to this question