The answer is scope creep may increase without proper controls, and this is the key risk an IS auditor should highlight when an organization transitions from waterfall to agile. In waterfall, scope is fixed early in the project, whereas agile’s iterative cycles and continuous feedback loops naturally invite ongoing change requests; without disciplined backlog prioritization and strict sprint boundaries, these changes can expand uncontrollably, leading to budget and timeline overruns. On the CISA exam, this question tests your understanding of governance over agile methodologies—specifically, that flexibility does not mean an absence of control, and auditors must flag the absence of a product owner’s authority to reject scope additions. A common trap is assuming agile inherently prevents scope creep, when in fact the risk of transitioning from waterfall to agile scope creep is heightened precisely because teams lack the rigid change control processes they once had. Memory tip: think “Sprint walls, not free-for-alls”—agile needs boundaries to keep scope in check.
CISA Practice Question: Information Systems Acquisition, Development and Implementation
This CISA practice question tests your understanding of information systems acquisition, development and implementation. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization is transitioning from a waterfall to an agile development methodology. Which of the following is a key risk that the IS auditor should highlight?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scope creep may increase without proper controls.
In agile development, iterative cycles and continuous feedback can lead to scope creep if changes are not managed through a disciplined backlog prioritization process. Unlike waterfall, where scope is fixed early, agile's flexibility requires robust controls (e.g., sprint boundaries, product owner authority) to prevent uncontrolled expansion. An IS auditor should highlight this risk because without proper governance, the project may exceed budget and timeline despite agile's adaptive nature.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
User requirements may be incomplete at the start.
Why it's wrong here
Incomplete requirements are a common waterfall risk, but agile embraces evolving requirements.
✗
Testing is deferred until the end of the project.
Why it's wrong here
Agile involves continuous testing, so this is not a risk.
✗
Stakeholder involvement may decrease.
Why it's wrong here
Agile requires constant stakeholder feedback, so involvement increases.
✓
Scope creep may increase without proper controls.
Why this is correct
Agile's iterative nature can lead to uncontrolled scope expansion if not managed.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates mistakenly think agile eliminates scope creep entirely, when in fact its flexibility requires even stronger controls to prevent uncontrolled expansion, especially during the transition from waterfall.
Detailed technical explanation
How to think about this question
Agile frameworks like Scrum use a product backlog and sprint backlog to control scope; each sprint has a fixed timebox, and changes are only introduced at sprint planning. Without strict backlog grooming and change control processes, stakeholders may inject unplanned features mid-sprint, causing velocity disruption and technical debt. Real-world examples include organizations adopting 'agile-fall' where scope creep occurs because the product owner lacks authority to reject changes.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Information Systems Acquisition, Development and Implementation — This question tests Information Systems Acquisition, Development and Implementation — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Scope creep may increase without proper controls. — In agile development, iterative cycles and continuous feedback can lead to scope creep if changes are not managed through a disciplined backlog prioritization process. Unlike waterfall, where scope is fixed early, agile's flexibility requires robust controls (e.g., sprint boundaries, product owner authority) to prevent uncontrolled expansion. An IS auditor should highlight this risk because without proper governance, the project may exceed budget and timeline despite agile's adaptive nature.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.