hardMultiple SelectObjective-mapped
Risks of Skipping the Design Phase in SDLC
An IS auditor is reviewing the system development life cycle (SDLC) for a custom application. The project manager has decided to skip the design phase and proceed directly from requirements to coding. Which of the following risks are MOST likely to increase as a result? (Choose two.)
Quick Answer
The answer is that skipping the design phase in SDLC most significantly increases the risks that the system will not meet user requirements and will have inadequate security controls. This occurs because the design phase is where high-level requirements are translated into a detailed technical blueprint, including system architecture, data flow, and security specifications. Without this structured translation, functional gaps emerge between what users need and what developers build, while security requirements—such as authentication, encryption, and input validation—are never formally integrated, leading to ad hoc, vulnerable implementations. On the CISA exam, this scenario tests your understanding of the SDLC as a risk management framework; a common trap is to focus on coding errors or budget overruns, but the core issue is that the design phase is the only stage where both functional and non-functional requirements are systematically reconciled. Remember the mnemonic “No Design, No Defense” to recall that skipping design directly undermines both user satisfaction and security posture.
⚠ Common exam trap
The trap here is that candidates focus on project management risks (schedule, cost, defects) rather than the specific security and requirements risks that are most directly amplified when the design phase is omitted, as the design phase is where both functional and non-functional requirements (including security) are translated into a technical blueprint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inadequate security controls.
Skipping the design phase means that security requirements are never formally defined or integrated into the system architecture. Without a security design, controls such as authentication, authorization, encryption, and input validation are likely to be omitted or implemented ad hoc, leading to inadequate security controls. This directly increases the risk of vulnerabilities that could be exploited in production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delays in project schedule.
Why it's wrong here
Skipping a phase could shorten schedule initially, not necessarily delay.
- ✗
Increased cost due to rework.
Why it's wrong here
Rework is more associated with testing, not specifically design.
- ✗
Increased number of defects during unit testing.
Why it's wrong here
Defects are more related to coding and testing, not design.
- ✓
Inadequate security controls.
Why this is correct
Security controls are often defined in the design phase.
- ✓
The system may not meet user requirements.
Why this is correct
Without design, the system may not fulfill requirements.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IS auditor is reviewing the system development life cycle (SDLC) methodology. Which phase should include the development of detailed test plans?
easy- A.Requirements definition.
- ✓ B.System design.
- C.Coding and unit testing.
- D.User acceptance testing.
Why B: Detailed test plans should be developed during the system design phase because this is when the system's architecture, interfaces, and data flows are fully specified. Creating test plans at this stage ensures that tests are aligned with the design specifications and can validate that the implemented system meets the intended technical requirements, rather than waiting until after coding.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.