Information Systems Acquisition, Development, and Implementation →mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is reviewing a contract for a new software solution. Which of the following contract types poses the HIGHEST risk to the buyer if requirements are not well-defined?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fixed-price contract
Fixed-price contracts are risky when requirements are unclear because the vendor may understate effort or charge high change orders. Time-and-materials contracts are safer for undefined requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Time-and-materials contract
Why it's wrong here
This type allows flexibility as the buyer pays for actual effort, reducing risk of scope disputes.
- ✓
Fixed-price contract
Why this is correct
If requirements change, the vendor may demand extra fees, leading to cost overruns and disputes.
- ✗
Cost-plus contract
Why it's wrong here
Similar to time-and-materials, cost-plus reimburses costs plus fee, which is less risky for undefined requirements.
- ✗
Outcome-based contract
Why it's wrong here
Outcome-based contracts tie payment to results, which can be risky if metrics are not clear, but generally align incentives.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.