mediumMultiple Choice
CISA Practice Question: During the acquisition of a new software package,…
During the acquisition of a new software package, the procurement team evaluates two vendors. Vendor A offers a lower upfront cost but higher annual maintenance fees. Vendor B has a higher upfront cost but includes three years of maintenance. What is the MOST important factor for the IS auditor to consider?
⚠ Common exam trap
CISA often tests the misconception that the lowest upfront cost or the vendor's reputation is the decisive factor, when the auditor's focus should be on lifecycle TCO and economic value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The total cost of ownership over the expected life of the system.
The IS auditor should focus on total cost of ownership (TCO) over the expected life of the system because it captures all direct and indirect costs—upfront licensing, annual maintenance, support, training, infrastructure, and eventual replacement—providing a true comparison between the two vendors. Vendor A's lower upfront cost may be misleading if higher annual maintenance fees accumulate over several years, while Vendor B's bundled three years of maintenance changes the long-term cost profile. TCO aligns with the auditor's role of evaluating the economic efficiency and value of the acquisition, not just the initial price.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The upfront cost of each vendor.
Why it's wrong here
Upfront cost ignores the total cost of ownership, so it cannot compare Vendor A's recurring maintenance against Vendor B's bundled three years. Upfront cost is tempting because procurement budgets are capital-constrained, and it is correct when the decision is a short-term cash-flow constraint rather than value over the contract life.
- ✗
The vendor's market reputation.
Why it's wrong here
Market reputation is subjective and cannot be quantified against the stem's cost trade-off; the auditor must compare total cost of ownership across the contract term. Reputation matters when assessing vendor viability or past delivery performance, not when weighing differing upfront and maintenance pricing structures.
- ✓
The total cost of ownership over the expected life of the system.
Why this is correct
Total cost of ownership captures acquisition plus recurring maintenance across the system's expected life, exposing Vendor A's higher annual fees against Vendor B's bundled three years. Comparing upfront price alone would mislead the auditor, since the stem deliberately trades initial cost against ongoing maintenance.
- ✗
The organization's budget constraints.
Why it's wrong here
Budget constraints address affordability, not the comparative cost structures the stem presents; the auditor must evaluate total cost of ownership over the full term. Budget limits would be decisive if both vendors exceeded available funding, but here the difference lies in cost distribution across years.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.