Chapter 3 of 5 · ISACA CISA
Acquisition, Development and Implementation
Project governance, business cases, development methods, control design, testing, release, migration and benefits review.
- 4topics
- 13 minfast track
- 1diagrams and exhibits
- 12%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Project Governance and the Business CaseProject roles and governance, scheduling and estimation, earned value, the business case, feasibility analysis and benefits…3 min
- 2Development Methodologies and Control DesignWaterfall, agile, prototyping, RAD and DevOps, build versus buy, and input, processing and output controls such as edit checks…4 min
- 3Implementation Testing and Release ManagementUnit, integration, system, acceptance and regression testing, test data, go-live readiness, and configuration and release…3 min
- 4Migration, Data Conversion and Post-Implementation ReviewParallel, phased, pilot and direct changeover, infrastructure deployment, data conversion controls and the post-implementation…Diagram3 min
About this chapter
What this chapter covers
Information Systems Acquisition, Development and Implementation is worth 12 percent of the CISA exam. It follows a system from idea to live use: whether the project is justified and governed, whether the solution is built or bought with the right controls, and whether it is tested, released and converted safely.
Acquisition and development (3A) covers project governance and management, business case and feasibility analysis, system development methodologies and control identification and design. Implementation (3B) covers system readiness and implementation testing, configuration and release management, system migration, infrastructure deployment and data conversion and the post-implementation review.
How the topics fit together
The earlier a control is designed in, the cheaper and more effective it is. The auditor's best contribution is at the requirements and design stages, while staying independent of the decisions.
When a question asks when the auditor should get involved in a development project, the answer is early, at requirements and design, to advise on controls, not only at the end.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.