CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An IS auditor is reviewing an agile project that uses Scrum. Which event provides the best opportunity for the auditor to assess whether completed user stories meet the defined acceptance criteria?
⚠ Common exam trap
CISA often tests the confusion between Scrum events, leading candidates to select the retrospective or daily standup instead of the sprint review for assessing completed work.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sprint review
The sprint review is the Scrum event where the team demonstrates completed work to stakeholders and gathers feedback, making it the best opportunity for an IS auditor to assess whether completed user stories meet the defined acceptance criteria. During the sprint review, the product owner and stakeholders review the increment and verify that it meets the acceptance criteria, providing a clear checkpoint for audit evidence. This event directly addresses the completion and acceptance of user stories.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sprint review
Why this is correct
The sprint review is where the team demonstrates completed user stories against their acceptance criteria with stakeholders present. This gives the auditor direct evidence of whether each story actually satisfies the defined criteria before it is accepted.
- ✗
Daily standup
Why it's wrong here
The daily standup is a fifteen-minute synchronisation covering progress, plans and impediments; no working increment is demonstrated or formally accepted. It tempts because completed work is mentioned, but that is a verbal status update, not evidence that user stories satisfy their acceptance criteria.
- ✗
Retrospective
Why it's wrong here
The retrospective examines team process, collaboration and tooling improvements after a sprint; it does not inspect individual user stories against their acceptance criteria. It tempts because it reviews the sprint just finished, yet its focus is ways of working, whereas acceptance-criteria verification happens when the increment is demonstrated.
- ✗
Sprint planning
Why it's wrong here
Sprint planning selects and estimates upcoming backlog work before any code exists, so no completed user story can be checked against acceptance criteria there. It tempts as the ceremony where acceptance criteria are discussed, but that discussion concerns future scope, not verification of finished increments.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.