CISA Practice Question: Information Systems Acquisition, Development, and Implementation

During a spiral model SDLC project, an IS auditor is reviewing risk assessment documentation. Which of the following would be the GREATEST concern?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Key risks identified in the first iteration are not reassessed in later iterations

The spiral model is risk-driven; failure to identify critical risks undermines the methodology and could lead to project failure.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Key risks identified in the first iteration are not reassessed in later iterations
Why this is correct
Risk reassessment is crucial in spiral model; risks can change.
✗
Risk mitigation plans are not documented
Why it's wrong here
While important, the identification of risks is foundational.
✗
The project uses a combination of waterfall and prototyping
Why it's wrong here
This is typical of the spiral model.
✗
Risk analysis is performed by the project manager alone
Why it's wrong here
While not best practice, it is less critical than failing to reassess risks.

Go deeper