CISA Practice Question: Information Systems Acquisition, Development, and Implementation
During a vendor evaluation for a critical system, the IS auditor notes that the vendor's SOC 2 report includes an adverse opinion. What should be the auditor's PRIMARY recommendation?
⚠ Common exam trap
CISA often tests the misconception that a well-known vendor's reputation or a price concession can offset an adverse SOC 2 opinion — candidates who pick A or C fail to recognize that control failures are not mitigated by commercial or reputational factors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Evaluate compensating controls or seek an alternative vendor
An adverse SOC 2 opinion means the service auditor found that controls were not suitably designed or operating effectively, so the vendor cannot be relied upon to protect the organization's data. The auditor's primary recommendation must therefore be to evaluate compensating controls the organization can apply or to seek an alternative vendor, since accepting the vendor as-is would transfer unacceptable risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Negotiate a lower price to offset the risk
Why it's wrong here
A price reduction does not remediate the control failures an adverse opinion identifies, so residual risk to a critical system remains unaddressed. It is tempting as a compensating commercial concession, but the auditor should recommend requiring remediation or selecting another vendor instead.
- ✓
Evaluate compensating controls or seek an alternative vendor
Why this is correct
An adverse SOC 2 opinion means the vendor's controls failed to meet trust services criteria, so the auditor should recommend evaluating compensating controls or selecting an alternative vendor. This directly addresses the assurance gap the adverse opinion creates for a critical system.
- ✗
Accept the risk because the vendor is well-known
Why it's wrong here
An adverse SOC 2 opinion means controls failed testing, so accepting risk on brand reputation alone ignores the identified control failures affecting a critical system. It is tempting when the vendor is established, but the auditor should recommend remediation or an alternative vendor, not acceptance.
- ✗
Request a customized SOC 2 report
Why it's wrong here
Requesting a customized report does not change the adverse opinion already issued; the underlying control deficiencies must be remediated and re-tested. It is tempting because tailored scope can add detail, but the auditor's primary recommendation should address the failed controls, not the report format.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.