9

CISA Domain 3: Full-Length Assessment Simulation

CISA Domain 3: Information Systems Acquisition, Development, and Implementation focuses on the lifecycle of IT systems—from initial business need through development, testing, deployment, and post-implementation review. This domain accounts for approximately 12% of the CISA exam and is critical for auditors who need to ensure that new systems are built, acquired, and implemented in a controlled, secure, and value-driven manner .

---

🎯 Core Objective

The primary goal is to evaluate the organization’s project management and system development practices to ensure that:

• Business requirements are met
• Systems are delivered on time and within budget
• Security, privacy, and control are embedded from the start
• Risks are identified and mitigated throughout the lifecycle

---

🔍 Key Areas of Focus

A. Project Governance and Management

• Business Case & Feasibility: Ensuring that projects are justified with clear cost-benefit analysis and alignment with business strategy.
• Project Charter: Verifying that scope, objectives, and stakeholder roles are clearly defined.
• Risk Management: Assessing how project risks are identified, tracked, and mitigated.
• Methodologies: Understanding the differences between waterfall, agile, DevOps, and hybrid approaches, and how each affects control and auditability.

B. System Development Life Cycle (SDLC) Controls

• Requirements Definition: Ensuring that user needs are accurately captured and validated.
• Design & Architecture: Reviewing that security, privacy (privacy-by-design), and data protection are integrated into system design.
• Development & Coding: Evaluating version control, code review practices, and segregation of duties between developers and production environments.
• Testing: Assessing the adequacy of unit, integration, system, and user acceptance testing (UAT). Independent testing is a key control.
• Data Migration: Validating that data cleansing, transformation, and reconciliation are properly planned and executed.

C. Implementation and Post-Implementation

• Go-Live Strategies: Evaluating risks associated with big bang vs. phased or parallel implementation approaches.
• Change Management: Ensuring that all changes to systems follow formal approval, testing, and rollback procedures.
• Post-Implementation Review (PIR): Conducting reviews to verify that the system delivers the expected business benefits and that any issues are remediated.

D. Vendor and Outsourcing Considerations

• Vendor Selection: Evaluating contracts for right-to-audit, source code escrow, service level agreements (SLAs), and security certifications.
• Third-Party Risk: Ensuring that outsourced development follows equivalent standards for security, quality, and compliance.

---

💡 Why It Matters for the CISA Exam

• High-Risk Scenarios: Questions often present ambiguous situations where you must choose the best audit response—not just the most obvious one.
• Balancing Speed vs. Control: Many questions test your ability to recommend controls without stifling innovation or delivery timelines.
• Real-World Application: You’ll be expected to think like an auditor who must assess whether the organization’s approach to system development adequately protects assets, ensures data integrity, and meets regulatory requirements.

In short, Domain 3 is about ensuring that IT investments deliver value securely and reliably—a core competency for any IS auditor .

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–

–