CISA Practice Question: Information Systems Acquisition, Development, and Implementation
During an agile software development project, which of the following events provides the best opportunity for the IS auditor to assess the effectiveness of controls implemented in the current sprint?
⚠ Common exam trap
CISA often tests the confusion between the sprint review (product demonstration) and the sprint retrospective (process improvement) — candidates who conflate the two pick the retrospective as the control-assessment venue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sprint review
The sprint review is where the team demonstrates the completed increment to stakeholders, making it the best venue for the auditor to observe working software and evaluate whether controls built into the sprint were actually implemented and effective. It provides tangible evidence of the increment, unlike planning or standup meetings which discuss future or in-progress work.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sprint planning meeting
Why it's wrong here
Sprint planning defines scope and selects backlog items before development begins, so controls in the current sprint have not yet been implemented and cannot be assessed there. It is tempting because planning does address control design and acceptance criteria, making it the right forum for reviewing intended controls rather than their operating effectiveness.
- ✓
Sprint review
Why this is correct
The sprint review demonstrates the completed increment to stakeholders, exposing working functionality and the controls embedded in it. This gives the auditor direct evidence of control effectiveness for the current sprint, unlike planning or retrospective sessions.
- ✗
Daily standup meeting
Why it's wrong here
The daily standup is a brief coordination meeting covering progress, plans and impediments; it produces no evidence of control design or operating effectiveness. It is tempting because it occurs every day and gives visibility into sprint work, and it would be correct for observing team communication and early risk escalation.
- ✗
Sprint retrospective
Why it's wrong here
The retrospective examines team process, collaboration and improvements; it reviews how the team worked rather than verifying control design or operating effectiveness against criteria. It is tempting because it is the sprint's reflective ceremony, and it would be correct for assessing process maturity or team dynamics, not control testing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.