mediumMultiple Choice
CISA Practice Question: An IS auditor finds that a project failed to meet…
An IS auditor finds that a project failed to meet its objectives because key stakeholders were not involved in the requirements definition phase. Which phase of the SDLC was most neglected?
⚠ Common exam trap
Many candidates confuse the symptoms of failure (e.g., poor design or failed tests) with the root cause, which is always the phase where the input was missing—requirements analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Requirements analysis
The requirements analysis phase is where stakeholder needs are formally captured and documented. Without key stakeholder involvement, the project lacks a validated baseline of what must be built, leading to misaligned objectives and scope creep. The IS auditor’s finding directly points to a failure in this phase, as it is the only SDLC phase that defines the project’s success criteria from the user’s perspective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Requirements analysis
Why this is correct
Stakeholder involvement is a requirements analysis activity; excluding them there produces unvalidated, incomplete requirements that cascade into a project failing its objectives. The neglected phase is therefore requirements analysis, where elicitation and sign-off should have occurred.
- ✗
Development
Why it's wrong here
Development builds from approved requirements; if stakeholders were absent during definition, the defect originates earlier, in the requirements-gathering phase, not coding. Development tempts because failures surface as built functionality, yet the neglected phase is where stakeholder input belongs.
- ✗
Design
Why it's wrong here
Design translates agreed requirements into architecture and specifications; it cannot compensate for stakeholders who never contributed them. It is tempting because design workshops do gather user feedback, and design would be the neglected phase if requirements were captured but the resulting solution ignored them. Here the gap sits earlier, in requirements definition.
- ✗
Testing
Why it's wrong here
Testing occurs after requirements are baselined, so it cannot remedy stakeholders' absence from definition; tests merely validate whatever was specified. It is tempting because testing validates deliverables against requirements, and would be the neglected phase if defects escaped to production or user acceptance criteria were unmet.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.