mediumMultiple Choice
CISA Practice Question: Using an agile development methodology for a…
A company is using an agile development methodology for a critical business application. The IS auditor is concerned about the lack of formal documentation. What is the BEST approach to mitigate this risk?
⚠ Common exam trap
A common mix-up: candidates confuse agile's 'working software over comprehensive documentation' with 'no documentation at all,' leading them to choose Option B, while the correct answer recognizes that lightweight documentation is both agile-compliant and risk-mitigating.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ask the team to maintain a lightweight document of important decisions and changes.
The best approach because it balances agile principles with the need for auditability. In agile, lightweight documentation (e.g., architecture decision records, user story acceptance criteria) captures key decisions and changes without the overhead of full waterfall documentation. This mitigates the risk of knowledge loss while preserving the team's velocity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require the project to switch to a waterfall methodology.
Why it's wrong here
Forcing waterfall replaces iterative delivery with sequential phases, which does not create the missing artefacts and disrupts the critical application's release cadence. Waterfall suits fixed-scope, regulated projects where requirements are stable and documentation is contractually mandated from the outset.
- ✗
Accept the lack of documentation because agile emphasizes working software.
Why it's wrong here
Accepting the gap leaves the risk untreated, so no compensating artefact records design decisions or change authorisation for the critical application. Acceptance is valid only for low-impact systems where documentation loss carries no audit or regulatory consequence.
- ✗
Perform a detailed code review to compensate for missing documentation.
Why it's wrong here
Code review examines implementation correctness, not the design rationale, requirements traceability or approval records an auditor needs. It is the right control when verifying code quality or defect density in a specific module, not for reconstructing governance evidence.
- ✓
Ask the team to maintain a lightweight document of important decisions and changes.
Why this is correct
Lightweight documentation of key decisions and changes preserves an audit trail of design rationale and approvals while respecting agile's preference for working software over comprehensive documentation. This satisfies the auditor's need for traceability without imposing heavyweight artefacts that would disrupt iterative delivery.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.