Information Systems Acquisition, Development, and Implementation →mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is reviewing a waterfall SDLC project that has completed the requirements phase. Which of the following is the greatest risk to the project?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A key business stakeholder did not sign off on the requirements.
In waterfall, requirements are defined upfront and changes are difficult. If a key stakeholder did not sign off, there is a risk that later phases will be based on incomplete or incorrect requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The project manager left the company.
Why it's wrong here
While impactful, it can be managed by reassignment; requirements sign-off is a critical control.
- ✓
A key business stakeholder did not sign off on the requirements.
Why this is correct
Without sign-off, requirements may not reflect actual needs, leading to rework.
- ✗
The development team is unfamiliar with the technology.
Why it's wrong here
This can be mitigated with training, but missing sign-off is more fundamental.
- ✗
The design phase is behind schedule.
Why it's wrong here
Schedule delays are common but not the greatest risk compared to incorrect requirements.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.