CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An organization is considering whether to build a custom application or purchase a commercial off-the-shelf (COTS) product. Which of the following factors would most strongly support a build decision?
⚠ Common exam trap
CISA often tests whether candidates can distinguish strategic differentiation (build) from operational efficiency (buy), so options emphasizing speed, SLAs, or resource constraints are distractors that actually favor buying.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The required functionality is unique to the organization's competitive advantage.
When the required functionality is unique to the organization's competitive advantage, building a custom application is justified because COTS products cannot provide differentiated capabilities that create strategic value. Custom development allows the organization to tailor features, integrate proprietary processes, and maintain exclusive control over the intellectual property. This factor most strongly supports a build decision because it directly ties the software to business differentiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Short time to market is critical.
Why it's wrong here
A short time to market favours COTS, since configuration and deployment deliver functionality faster than a full development lifecycle. Build decisions rest on unique requirements no vendor product satisfies, not on schedule pressure, which custom development lengthens rather than shortens.
- ✗
The vendor offers a robust service-level agreement (SLA).
Why it's wrong here
A vendor SLA governs an externally supplied product, so it supports purchasing rather than building; a custom application has no vendor to hold accountable. SLAs matter when contracting for hosted or licensed services where availability and support commitments must be contractually enforced.
- ✓
The required functionality is unique to the organization's competitive advantage.
Why this is correct
Functionality delivering competitive advantage is organisation-specific and unlikely to exist in a COTS product, so purchasing would force costly customisation or forfeit differentiation. Building internally lets the organisation own and tailor that capability, satisfying the strategic requirement that drives the build decision.
- ✗
The organization has limited in-house development resources.
Why it's wrong here
Limited in-house development resources argue against building, because custom delivery demands sustained internal design, coding and maintenance capability. Building becomes justified when requirements are so distinctive that no COTS product meets them and the organisation can support the resulting application.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.