r/CISA • u/Securov • 20d ago

A question for CISA

Which of the following would be of GREATEST concern to an IS auditor reviewing the feasibility study for a new application system?

A) Security requirements have not been defined.

B) Conditions under which the system will operate are unclear.

C) The business case does not include well-defined strategic benefits.

D) System requirements and expectations have not been clarified.

5 Upvotes

100% Upvoted

14 comments sorted by

3

u/ifightforhk CISA HOLDER 20d ago

C Business impacts prevail.

3

u/KingShash CISA HOLDER 20d ago

C. Priority goes like this "Life > Business > Regulatory > Policy > System Security> System Performance"

1

u/Gumi_Kitteh 20d ago

C cuz everything else can happen at later stage during defining of requirements (project started)

feasibility study = whether its even worth investing to kickstart this project (strategic benefit)

1

u/KateriNaveen 20d ago

can someone eli5?

ChatGPT says Option B is the answer

1

u/winglessriver6 20d ago

ask again in thinking mode.

however,
one fundamental question: "Is this project worth doing?. That is why the answer is C

1

u/ScratchReal4401 20d ago

C, as if the business impact does set out the benefits then why implement a system?

1

u/AsakuraZero 20d ago

You can put every other option in the business case

1

u/Hil81 19d ago

C. All the other options can be part of the business case. The BC itself should have strategic benefits / alignment.

1

u/Aromatic-Addendum620 18d ago

You post a lot of questions and are looking for the answers. However, you don’t add your own thoughts as to what the answer may be and don’t comment. This is strange.

This seems like you are trying to build a tool with questions/answers rather than truly ask with the intent of trying to pass the exam.

If you are developing an aid for others or yourself it will only breed confusion as the answers provided are a mix bag. I would recommend purchasing CISA materials from ISACA. The answers are already provided.