CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An organization is implementing a new CRM system using an agile methodology. The IS auditor wants to assess whether security requirements are being addressed. What is the best evidence for the auditor to review?
⚠ Common exam trap
CISA often tests the misconception that high-level documents like security policies or architecture diagrams provide sufficient evidence of security implementation in agile projects, when in fact the product backlog is the authoritative source for work items.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The product backlog
In agile development, the product backlog is the single source of truth for all work items, including security requirements. Security features and controls are captured as backlog items (e.g., user stories, acceptance criteria) and prioritized alongside functional requirements. Therefore, reviewing the product backlog provides direct evidence that security requirements are being addressed in the current development effort. Other artifacts like policies or architecture documents may exist but do not show whether security is actively being worked on in the sprint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security policy
Why it's wrong here
A security policy states organisational intent at a generic level; it does not evidence that this CRM's security requirements were defined or addressed. It is tempting because policies are the usual baseline for audits, but they are not project-specific artefacts and cannot show agile requirement coverage.
- ✗
The sprint retrospective minutes
Why it's wrong here
Retrospective minutes record process improvements and team dynamics, not the security requirements themselves or their implementation status. They are tempting because retrospectives are a core agile ceremony where issues surface, but they capture opinions rather than documented, verifiable security criteria.
- ✗
The system architecture document
Why it's wrong here
An architecture document describes intended design, not whether security requirements were elicited, tracked and validated during sprints. It is tempting because architecture artefacts do record security controls, but in agile delivery the evidence of requirement handling sits in the backlog and user stories.
- ✓
The product backlog
Why this is correct
In agile development, security requirements must be captured as backlog items to be estimated, built and tested. Reviewing the product backlog shows whether such requirements exist as user stories with acceptance criteria, providing direct evidence that security is being addressed rather than assumed.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.