CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is reviewing a project to implement a new loan origination system. The project manager has produced a detailed work breakdown structure (WBS), a critical path schedule, and a resource-loaded plan. Which of the following should the auditor verify FIRST to assess whether the project schedule is realistic?
⚠ Common exam trap
The trap here is assuming that an approved charter and budget validate the schedule, when schedule realism depends on dependency logic and resource leveling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
That the critical path includes all tasks with zero float and that resource constraints have been leveled against actual availability.
A realistic schedule requires correct logical dependencies and accurate resource assumptions. Zero-float tasks define the critical path, but if that path is built without leveling against actual staff availability, the projected end date is unreliable. Confirming that critical path tasks are sequenced properly and that resourcing reflects real capacity gives the auditor the strongest evidence about schedule feasibility before examining other project artifacts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
That the project sponsor has signed the project charter and that the budget has been approved by the finance committee.
Why it's wrong here
Charter and budget approvals are governance prerequisites, but they do not validate whether the schedule itself is achievable. A project can be fully funded yet still have an unrealistic timeline. For this scenario, the auditor is assessing schedule realism, so confirming sponsorship and funding does not test the validity of the critical path or the resource assumptions embedded in the plan.
- ✗
That the WBS has been decomposed to at least three levels and that each work package has a unique identifier.
Why it's wrong here
WBS depth and numbering conventions are structural quality checks, not tests of schedule feasibility. A deeply decomposed WBS can still produce an unrealistic timeline if durations, dependencies, or resource constraints are wrong. For this audit objective, the critical question is whether the schedule reflects real capacity, not whether the work breakdown follows a particular formatting standard.
- ✗
That all project risks have been entered into the risk register and assigned an owner with a mitigation plan.
Why it's wrong here
Risk register completeness is important for overall project governance, but it does not establish whether the schedule is realistic. A thorough risk register could exist alongside a schedule that ignores resource contention. The auditor's first concern here is the internal consistency of the schedule, so risk documentation is secondary to validating dependencies and resource availability.
- ✓
That the critical path includes all tasks with zero float and that resource constraints have been leveled against actual availability.
Why this is correct
A credible schedule must reflect both logical dependencies and real resource availability. If the critical path is calculated without leveling against actual staff, the plan can show an impossibly short duration. The auditor should first confirm that zero-float tasks are correctly sequenced and that resourcing assumptions match the people actually assigned, because every later schedule claim depends on this foundation.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.