CISA Practice Question: Information Systems Acquisition, Development, and Implementation

An organization is selecting a vendor for a new procurement system. Which of the following is the MOST important factor to include in the contract?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Right to audit the vendor's security controls

Audit rights ensure the organization can verify vendor controls and compliance, which is critical for outsourcing.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A clause limiting vendor liability
Why it's wrong here
Limiting liability may reduce vendor accountability.
✗
Fixed price for the entire contract term
Why it's wrong here
Pricing is important but audit rights provide oversight.
✗
Detailed service level agreements (SLAs)
Why it's wrong here
SLAs are important but audit rights enable verification.
✓
Right to audit the vendor's security controls
Why this is correct
This allows the organization to assess vendor compliance.

Go deeper