Here are detailed, exam-focused notes on Domain 3 of the CISA (Certified Information Systems Auditor) certification:

📘 CISA Domain 3: Information Systems Acquisition, Development & Implementation (≈12%)

This domain focuses on how organizations build, acquire, test, and implement information systems while ensuring proper controls, governance, and risk management.

🔑 1. Project Governance & Management

🔹 Key Concepts:

Alignment of IT projects with business objectives
Use of project management frameworks
Monitoring project performance (time, cost, quality)

🔹 Important Points:

Projects must have:
- Clear scope
- Defined deliverables
- Budget & timeline
Use tools like:
- Gantt charts
- Critical Path Method (CPM)

🔹 Risks:

Scope creep
Cost overrun
Poor stakeholder involvement

🔹 Controls:

Steering committee oversight
Periodic status reporting
Change approval process

🔹 Example:

A bank implementing a mobile app fails due to unclear scope → Auditor checks governance and finds no formal project charter.

🔑 2. Business Case & Feasibility Analysis

🔹 Types of Feasibility:

Technical feasibility – Can system be built?
Economic feasibility – Cost vs benefits
Operational feasibility – Will users accept it?
Legal feasibility – Compliance with laws

🔹 Important Metrics:

ROI (Return on Investment)
NPV (Net Present Value)
Payback Period

🔹 Example:

A company invests ₹50 lakh in ERP:

Expected savings ₹10 lakh/year
Payback period = 5 years

👉 Auditor checks whether assumptions are realistic.

🔑 3. System Development Life Cycle (SDLC)

🔹 Phases:

Initiation
Requirement Analysis
Design
Development
Testing
Implementation
Maintenance

🔹 Key Exam Points:

Each phase must have:
- Documentation
- Approval
Errors fixed earlier → cheaper

🔹 Controls:

Phase-end reviews
User sign-offs
Documentation standards

🔹 Example:

Missing requirement documentation → leads to system not meeting user needs.

🔑 4. SDLC Models / Methodologies

🔹 Types:

Waterfall Model (sequential)
Agile Model (iterative & flexible)
Spiral Model (risk-driven)
RAD (Rapid Application Development)

🔹 Comparison:

Model	Best For	Risk
Waterfall	Stable requirements	Inflexible
Agile	Changing requirements	Less documentation
Spiral	High-risk projects	Complex

🔹 Example:

Startup uses Agile → frequent updates but weak documentation → audit issue.

🔑 5. Requirements Management

🔹 Types:

Functional requirements
Non-functional (security, performance)

🔹 Key Points:

Requirements must be:
- Clear
- Complete
- Approved

🔹 Risks:

Ambiguous requirements
Frequent changes

🔹 Controls:

Requirement traceability matrix (RTM)
User validation

🔹 Example:

ATM system lacks security requirement → leads to fraud risk.

🔑 6. System Design & Development Controls

🔹 Key Concepts:

Input, processing, output controls
Secure coding practices

🔹 Important Controls:

Data validation checks
Error handling
Encryption

🔹 Risks:

Poor coding → vulnerabilities
Lack of testing

🔹 Example:

No input validation → user enters invalid data → system crash.

🔑 7. Testing Methodologies

🔹 Types of Testing:

Unit testing
Integration testing
System testing
User Acceptance Testing (UAT)

🔹 Key Points:

UAT must be done by users
Testing should be documented

🔹 Risks:

Incomplete testing
Lack of test data

🔹 Example:

Payroll system tested without real scenarios → wrong salary calculations.

🔑 8. Data Conversion & Migration

🔹 Key Points:

Accuracy and completeness of data
Data cleansing before migration

🔹 Risks:

Data loss
Data corruption

🔹 Controls:

Reconciliation checks
Backup before migration

🔹 Example:

Customer records lost during migration → business disruption.

🔑 9. System Implementation & Deployment

🔹 Methods:

Direct Cutover (risky)
Parallel Run (safe but costly)
Phased Implementation
Pilot Implementation

🔹 Example:

Bank uses parallel run → compares old & new system outputs.

🔑 10. Post-Implementation Review (PIR)

🔹 Purpose:

Evaluate system performance
Check if objectives achieved

🔹 Key Points:

Identify lessons learned
Improve future projects

🔹 Example:

ERP system implemented but users unhappy → PIR reveals lack of training.

🔑 11. Change Management

🔹 Key Concepts:

Managing system changes
Prevent unauthorized modifications

🔹 Controls:

Change requests
Approval process
Version control

🔹 Risks:

Unauthorized changes
System instability

🔹 Example:

Developer modifies code directly → causes system failure.

🔑 12. Segregation of Duties (SoD)

🔹 Key Principle:

No single person should:

Develop
Test
Deploy

🔹 Example:

Same person coding & approving → fraud risk.

🎯 MOST IMPORTANT EXAM HIGHLIGHTS

✔ Auditor focus areas:

SDLC controls
Testing completeness
Change management
Data migration accuracy

✔ Frequently tested concepts:

UAT responsibility (users, not IT)
Early error detection saves cost
Parallel run = safest implementation method
RTM ensures all requirements covered

🧠 Quick Revision Summary

SDLC must be controlled and documented
Testing is critical before implementation
Data migration requires validation
Change management prevents unauthorized access
Governance ensures project success

www.gmsisuccess.in

Here are 100 tricky, exam-oriented questions on CISA Domain 3 (MCQs, Assertion-Reason, Fill in the Blanks, Odd One Out, etc.) with answers. These are designed to test concept clarity, audit judgment, and traps commonly seen in CISA exams.

📘 SECTION A: MCQs (1–50)

1.

The MOST critical factor for project success is: A. Budget approval
B. User involvement
C. Technical feasibility
D. Vendor selection
✅ Answer: B

2.

Which SDLC phase is MOST effective for detecting errors at lowest cost? A. Testing
B. Design
C. Requirement analysis
D. Implementation
✅ Answer: C

3.

An auditor reviewing SDLC should FIRST check: A. Test results
B. Documentation
C. Business case
D. Coding standards
✅ Answer: C

4.

The PRIMARY objective of UAT is: A. Identify coding errors
B. Validate user requirements
C. Test system integration
D. Verify database integrity
✅ Answer: B

5.

Which implementation method has HIGHEST risk? A. Parallel
B. Phased
C. Pilot
D. Direct cutover
✅ Answer: D

6.

Which control ensures all requirements are addressed? A. Change log
B. RTM
C. Test plan
D. Audit trail
✅ Answer: B

7.

Agile methodology emphasizes: A. Documentation
B. Sequential phases
C. Iterative development
D. Fixed requirements
✅ Answer: C

8.

Which is a key risk in Agile? A. Slow delivery
B. Excess documentation
C. Weak documentation
D. No testing
✅ Answer: C

9.

MOST important control in data migration: A. Encryption
B. Backup
C. Reconciliation
D. Compression
✅ Answer: C

10.

Which role should perform UAT? A. Developer
B. Auditor
C. End user
D. Tester
✅ Answer: C

11.

Scope creep occurs due to: A. Strong controls
B. Poor requirement definition
C. Good governance
D. Fixed scope
✅ Answer: B

12.

Which is NOT a feasibility type? A. Technical
B. Operational
C. Financial
D. Coding
✅ Answer: D

13.

The BEST method for high-risk projects: A. Waterfall
B. Agile
C. Spiral
D. RAD
✅ Answer: C

14.

Which control prevents unauthorized code changes? A. Testing
B. Version control
C. Documentation
D. Backup
✅ Answer: B

15.

The PRIMARY purpose of PIR: A. Debug system
B. Evaluate success
C. Train users
D. Develop code
✅ Answer: B

16.

Which is a preventive control? A. Audit logs
B. Error reports
C. Input validation
D. Reconciliation
✅ Answer: C

17.

Which phase defines system architecture? A. Development
B. Design
C. Testing
D. Maintenance
✅ Answer: B

18.

Which testing ensures modules work together? A. Unit
B. System
C. Integration
D. UAT
✅ Answer: C

19.

MOST critical in change management: A. Speed
B. Approval
C. Coding
D. Testing
✅ Answer: B

20.

Which is detective control? A. Encryption
B. Input validation
C. Logs review
D. Access control
✅ Answer: C

21–50 (condensed but tricky)

RTM links → Requirements to testing ✅
Parallel run → Safest method ✅
Agile best for → Changing requirements ✅
Waterfall risk → Inflexibility ✅
Missing UAT → User dissatisfaction ✅
Data cleansing → Before migration ✅
SoD violation → Same person dev + deploy ✅
Critical path → Longest project duration path ✅
Payback period → Time to recover investment ✅
NPV considers → Time value of money ✅
Lack of documentation → Audit risk ✅
Pilot → Limited rollout ✅
Phased → Step-by-step implementation ✅
Direct cutover → No fallback ✅
Change log → Tracks modifications ✅
Test data → Must be realistic ✅
Security requirement → Non-functional ✅
Functional requirement → System behavior ✅
Error handling → Development control ✅
Encryption → Confidentiality control ✅
Testing incomplete → High risk ✅
Requirement ambiguity → Rework cost ↑ ✅
Early detection → Cost ↓ ✅
Audit trail → Accountability ✅
System failure → Poor testing ✅
Governance → Oversight role ✅
Stakeholder involvement → Critical ✅
Budget overrun → Poor planning ✅
Change approval → Mandatory ✅
Documentation → Evidence for audit ✅

📘 SECTION B: ASSERTION–REASON (51–70)

51.

Assertion: UAT is performed by users
Reason: Users validate business needs
A. Both true & reason correct
✅ Answer: A

52.

Assertion: Agile requires heavy documentation
Reason: Agile focuses on flexibility
✅ Answer: D (Assertion false, Reason true)

53.

Assertion: Parallel run reduces risk
Reason: Both systems run together
✅ Answer: A

54.

Assertion: Direct cutover is safest
Reason: No overlap exists
✅ Answer: D

55.

Assertion: RTM ensures requirement coverage
Reason: It maps requirements to tests
✅ Answer: A

56–70 (pattern-based answers)

Spiral reduces risk → True
Missing documentation → Audit issue → True
Testing after deployment → Wrong → False
Change mgmt prevents unauthorized changes → True
UAT by developers → False
Data migration without backup → Risk → True
Agile less documentation → True
Waterfall flexible → False
SoD reduces fraud → True
PIR improves future → True
Input validation prevents errors → True
Encryption ensures integrity → False (confidentiality)
Logs are preventive → False
Testing optional → False
Requirements must be approved → True

📘 SECTION C: FILL IN THE BLANKS (71–85)

______ ensures requirement coverage → RTM
______ is user-based testing → UAT
______ method runs two systems → Parallel
______ is highest risk implementation → Direct cutover
______ phase defines requirements → Analysis
______ feasibility checks cost-benefit → Economic
______ ensures data accuracy → Reconciliation
______ control prevents errors → Preventive
______ tracks system changes → Change log
______ ensures no single control → SoD
______ testing checks modules → Integration
______ review done after implementation → PIR
______ model is iterative → Agile
______ risk arises from unclear requirements → Scope creep
______ ensures secure coding → Development controls

📘 SECTION D: ODD ONE OUT (86–95)

Waterfall, Agile, Spiral, Encryption
✅ Answer: Encryption

UAT, System Testing, Integration Testing, Encryption
✅ Answer: Encryption

RTM, Change log, Audit trail, Payroll
✅ Answer: Payroll

Technical, Operational, Legal, Coding
✅ Answer: Coding

Parallel, Pilot, Phased, Encryption
✅ Answer: Encryption

Input validation, Logs, Encryption, Backup
✅ Answer: Logs (detective)

Developer, Tester, Auditor, End user (UAT)
✅ Answer: Auditor

ROI, NPV, Payback, Firewall
✅ Answer: Firewall

Requirement, Design, Testing, Payroll
✅ Answer: Payroll

Preventive, Detective, Corrective, Development
✅ Answer: Development

📘 SECTION E: CASE-BASED LOGIC (96–100)

96.

System failed due to missing requirements
👉 Root cause?
✅ Answer: Poor requirement analysis

97.

Data mismatch after migration
👉 Best control missing?
✅ Answer: Reconciliation

98.

Unauthorized code deployed
👉 Control failure?
✅ Answer: Change management

99.

Users reject system
👉 Reason?
✅ Answer: No UAT / poor requirement validation

100.

Project exceeds budget & time
👉 Root cause?
✅ Answer: Poor project governance / scope creep

🎯 FINAL EXAM STRATEGY

✔ Focus on:

SDLC controls
UAT responsibility
Data migration risks
Change management
Implementation methods

✔ Golden rules:

Users validate, not developers
Earlier error detection = cheaper
Parallel = safest
RTM = coverage assurance

Wednesday, April 1, 2026

CISA Domain 3 notes & question answer

📘 CISA Domain 3: Information Systems Acquisition, Development & Implementation (≈12%)

🔑 1. Project Governance & Management

🔹 Key Concepts:

🔹 Important Points:

🔹 Risks:

🔹 Controls:

🔹 Example:

🔑 2. Business Case & Feasibility Analysis

🔹 Types of Feasibility:

🔹 Important Metrics:

🔹 Example:

🔑 3. System Development Life Cycle (SDLC)

🔹 Phases:

🔹 Key Exam Points:

🔹 Controls:

🔹 Example:

🔑 4. SDLC Models / Methodologies

🔹 Types:

🔹 Comparison:

🔹 Example:

🔑 5. Requirements Management

🔹 Types:

🔹 Key Points:

🔹 Risks:

🔹 Controls:

🔹 Example:

🔑 6. System Design & Development Controls

🔹 Key Concepts:

🔹 Important Controls:

🔹 Risks:

🔹 Example:

🔑 7. Testing Methodologies

🔹 Types of Testing:

🔹 Key Points:

🔹 Risks:

🔹 Example:

🔑 8. Data Conversion & Migration

🔹 Key Points:

🔹 Risks:

🔹 Controls:

🔹 Example:

🔑 9. System Implementation & Deployment

🔹 Methods:

🔹 Example:

🔑 10. Post-Implementation Review (PIR)

🔹 Purpose:

🔹 Key Points:

🔹 Example:

🔑 11. Change Management

🔹 Key Concepts:

🔹 Controls:

🔹 Risks:

🔹 Example:

🔑 12. Segregation of Duties (SoD)

🔹 Key Principle:

🔹 Example:

🎯 MOST IMPORTANT EXAM HIGHLIGHTS

🧠 Quick Revision Summary

📘 SECTION A: MCQs (1–50)

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.