D3: Information Systems Acquisition, Development and Implementation
CISA (ISACA) study guide
CISA D3: Information Systems Acquisition, Development and Implementation
Domain 3 (12% weight, the smallest on the exam) follows a system from idea to production: business case and feasibility, project management, development methodologies, testing, application controls, implementation, and post-implementation review. The recurring theme is timing. Controls are cheapest and most effective when designed in early, and the auditor's job is to confirm they were, without becoming part of the design team.
Business case and feasibility
The business case justifies the investment in terms of benefits, costs, and risks. It should be revisited at key project milestones, not written once and forgotten. If the business case is no longer valid partway through, the right answer is to re-evaluate the project, not push it through.
SDLC and development approaches
Traditional (waterfall) SDLC moves through feasibility, requirements, design, development, testing, implementation, and post-implementation, with formal sign-offs between phases. Agile delivers in short iterations with lighter documentation. In agile, the auditor looks for controls embedded in each iteration (definition of done, code review, automated testing) rather than phase-gate documents.
Testing levels
Unit testing covers individual modules; integration testing covers interfaces between modules; system testing covers the whole system against specifications, including security and performance; user acceptance testing (UAT) has business users confirm it meets their needs. Final acceptance sign-off belongs to the business, not IT.
Application controls
Input controls (validation edits such as range, limit, reasonableness, check digit, and completeness checks), processing controls (run-to-run totals, batch totals, reconciliations), and output controls (distribution, reconciliation, retention). The most effective place to catch an error is at input, before it propagates.
Change and configuration management
Every change to production should be requested, approved, tested, and migrated by someone other than the developer who wrote it. Emergency changes are allowed but must be logged and approved after the fact. A developer who can move their own code to production is a classic segregation-of-duties finding.
Source code escrow
When licensing software from a vendor, a third party holds the source code in escrow, released to the customer if the vendor goes out of business or stops supporting the product. It protects continuity for vendor-built systems the organization can't maintain itself.
Post-implementation review (PIR)
Performed once the system has stabilized in production, typically weeks to months after go-live, to assess whether the business case's benefits were realized and what lessons apply to future projects. A review done the day after go-live can't measure benefits realization.
Parallel vs. pilot vs. phased vs. direct changeover
Parallel runs the old and new systems side by side (lowest risk, highest cost). Pilot rolls the new system out to one site or group first. Phased replaces the old system module by module. Direct (abrupt) cutover switches everything at once (cheapest, highest risk). A question about the safest changeover points to parallel.
Batch total vs. hash total
A batch (control) total sums a meaningful field, such as the dollar amount of all invoices in a batch. A hash total sums a field that has no meaning when added, such as account numbers, purely to detect lost, added, or altered records. Both verify completeness; only the batch total produces a number anyone uses.
Auditor involvement vs. auditor ownership
Auditors should be consulted during design to recommend controls, since that is when controls are cheapest to add. But the auditor does not design, approve, or sign off the system, because that would compromise independence when auditing it later.
Sources: ;
CISA practice exams are in development. Get every CISA domain in one printable guide, free with an account.
Get the Complete Guide