Information Systems Acquisition, Development, and Implementation →hardMultiple SelectObjective-mapped
CISA Practice Question: Information Systems Acquisition, Development, and Implementation
An organization is implementing a new CRM system using an iterative development methodology. The IS auditor wants to verify that appropriate controls are in place. Which THREE of the following are essential controls for iterative development? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk assessment at the start of each iteration
Iterative development requires continuous stakeholder involvement, version control, and risk assessment each iteration. These controls ensure the evolving system meets requirements and manages risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Formal sign-off on a complete requirements document before development begins
Why it's wrong here
Iterative methods embrace changing requirements; upfront sign-off is counterproductive.
- ✓
Risk assessment at the start of each iteration
Why this is correct
Iterative risk assessment helps identify and mitigate new risks.
- ✓
Version control and configuration management
Why this is correct
Essential to manage changes across iterations.
- ✗
A mandatory change control board for every change
Why it's wrong here
Iterative development involves many small changes; a full CAB for each is impractical.
- ✓
Frequent stakeholder reviews and feedback after each iteration
Why this is correct
Stakeholder feedback ensures the system aligns with needs.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.