CISA Domain 3A-2 Practice Test 001

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A-2 (Business Case and Feasibility Analysis) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3A-2 Business Case and Feasibility Analysis Practice Test 001

10 questions • Single best answer

Question 1

A government agency plans to procure a citizen-benefits platform to replace a legacy system. The IS auditor reviewing the supporting business case notes that it lists expected costs and vendor features in detail but omits quantified benefits, alternatives considered, and any linkage to the agency's strategic objectives. Which of the following is the MOST significant weakness in the business case?

A. The business case does not specify the vendor's technical support model. B. The business case does not include a detailed project schedule. C. The business case does not quantify expected benefits or link them to strategic objectives. D. The business case does not identify the members of the implementation team.

Question 2

During an audit of a proposed customer-analytics system at a telecommunications company, the IS auditor finds that the feasibility study evaluated only economic feasibility and did not address technical or operational feasibility. Management states the vendor has confirmed the solution will work in their environment. What should the IS auditor do FIRST?

A. Rely on the vendor's confirmation that the solution will work. B. Determine whether the omitted feasibility dimensions were assessed elsewhere or represent a genuine gap. C. Recommend that management cancel the project immediately. D. Report that the feasibility study is complete and adequate.

Question 3

An audit manager is reviewing how a bank approved investment in a new loan-origination system. The manager wants assurance that the decision was justified before spending was committed, and several artifacts from the approval file are available for inspection. Which of the following provides the BEST evidence that the investment decision was supported by a sound business case?

A. A signed contract with the selected software vendor. B. A presentation deck summarizing the new system's key features. C. An email from IT confirming that the system meets requirements. D. A documented cost-benefit analysis comparing alternatives and approved by the investment committee.

Question 4

A manufacturing firm approved a warehouse-automation system based on a business case that projected a three-year payback period. During the audit, the IS auditor finds that the projected benefits relied almost entirely on headcount reductions, but the HR director confirms that no such reductions are planned or will occur. Which finding is MOST significant?

A. The business case's benefit projections are based on assumptions that will not materialize. B. The business case did not include a sensitivity analysis of key assumptions. C. The projected payback period exceeds two years. D. The business case was not reviewed by the internal audit function.

Question 5

An IS auditor is evaluating whether a completed CRM investment delivered the value promised in its business case. The original business case defined expected benefits in general terms, but no baseline performance metrics were captured before the system was deployed into production. Which of the following is the auditor's BEST conclusion?

A. The investment failed to deliver any value. B. Benefits realization is confirmed because the system is operational. C. Benefits realization cannot be reliably measured without pre-implementation baseline metrics. D. The business case should have relied on net present value rather than a simple payback calculation to justify the investment.

Question 6

A healthcare organization is evaluating a major investment in a new electronic health record platform. The IS auditor observes that the business case was prepared, reviewed, and approved solely within the IT department, with no involvement from clinical or finance leadership. Which of the following is the MOST appropriate recommendation?

A. The business case should be prepared by an independent external consultant. B. Business owners and a governance body, not IT alone, should approve the business case. C. The business case should focus mainly on technical specifications. D. The IT department should retain ownership of the business case because it best understands the technical solution and the vendor landscape.

Question 7

A financial-services firm uses a discounted cash flow method to justify a multiyear data-platform investment spanning several budget cycles. The IS auditor wants to assess whether the analysis appropriately reflects the time value of money across the full investment horizon. Which element is MOST important for the auditor to verify?

A. That an appropriate discount rate was applied to future cash flows. B. That the total nominal costs and nominal benefits were both recalculated using current-year figures without any adjustment. C. That the payback period is under twelve months. D. That all costs were recorded in the current fiscal year.

Question 8

A public utility's business case for a new mobile field-service application relies heavily on intangible benefits, such as improved employee morale and an enhanced brand image, to justify the expenditure. Only a small portion of the projected value is tied to measurable cost savings. What is the IS auditor's BEST course of action regarding these benefits?

A. Reject the business case outright because intangible benefits such as morale and brand image can never be measured or defended. B. Accept the intangible benefits at the value management assigned. C. Recommend converting all intangible benefits into headcount savings. D. Assess whether the intangible benefits are supported by reasonable and documented justification.

Question 9

During a pre-implementation review of an insurer's claims-processing upgrade, the IS auditor notes that the business case evaluated only the preferred vendor solution. No comparison was made to other available options or to the cost of retaining the existing platform. Which of the following is the MOST significant concern?

A. The business case document was longer than fifty pages. B. The business case did not compare alternative options, including retaining the current system. C. The business case did not identify the executive project sponsor who is responsible for approving ongoing funding decisions. D. The business case did not include user interface mockups.

Question 10

An IS auditor concludes that a recently implemented logistics system did not achieve the operational cost savings that were promised in its approved business case. Management acknowledges the shortfall but considers the matter closed. Which of the following is the MOST appropriate action for the auditor to take?

A. Recommend decommissioning the logistics system immediately. B. Take no action because the business case is now historical and the system is already fully in production use. C. Report the benefit shortfall and recommend a process to validate future business case projections. D. Conclude the project was successful because it was delivered on schedule.

Related Posts

Leave a Comment Cancel Reply