CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An organization is deciding between building a custom application and purchasing a commercial off-the-shelf (COTS) product. The primary factor favoring the build option is:
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Greater control over features
Building a custom application allows for tailored functionality that meets unique business requirements, which is a key advantage over COTS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Greater control over features
Why this is correct
Building in-house gives the organization direct authority over the application's feature roadmap, letting it tailor functionality to unique business processes rather than adapting to a vendor's fixed release cycle. This satisfies the stem's decision factor: where differentiation or specialised requirements matter, custom development delivers feature control that COTS licensing cannot.
- ✗
Faster time to market
Why it's wrong here
Custom development typically lengthens delivery because requirements, design, coding and testing all precede release, whereas COTS is deployed sooner. Faster time to market is tempting as an assumed benefit of control, but it actually favours purchasing, not building.
- ✗
Lower initial cost
Why it's wrong here
Custom builds typically carry higher upfront development costs than licensing a COTS product, so lower initial cost favours buying, not building. Building is chosen when unique functionality, integration or competitive differentiation cannot be met by any packaged offering.
- ✗
Reduced vendor dependency
Why it's wrong here
Reduced vendor dependency is a secondary benefit, not the primary factor favouring build. Avoiding lock-in is tempting because custom code grants control over the roadmap, but organisations build chiefly when no COTS product meets required functionality or regulatory fit.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.