mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Using an agile development methodology for a…
A company is using an agile development methodology for a critical business application. The IS auditor is concerned about the lack of formal documentation. What is the BEST approach to mitigate this risk?
⚠ Common exam trap
A common mix-up: candidates confuse agile's 'working software over comprehensive documentation' with 'no documentation at all,' leading them to choose Option B, while the correct answer recognizes that lightweight documentation is both agile-compliant and risk-mitigating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ask the team to maintain a lightweight document of important decisions and changes.
The best approach because it balances agile principles with the need for auditability. In agile, lightweight documentation (e.g., architecture decision records, user story acceptance criteria) captures key decisions and changes without the overhead of full waterfall documentation. This mitigates the risk of knowledge loss while preserving the team's velocity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require the project to switch to a waterfall methodology.
Why it's wrong here
Changing methodology is drastic and may not be feasible.
- ✗
Accept the lack of documentation because agile emphasizes working software.
Why it's wrong here
Auditors need evidence of controls and decisions.
- ✗
Perform a detailed code review to compensate for missing documentation.
Why it's wrong here
Code review does not replace documentation for audit trail.
- ✓
Ask the team to maintain a lightweight document of important decisions and changes.
Why this is correct
This balances agile flexibility with audit requirements.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.