CISA Domain 3A-2 Practice Test 002

This practice test covers Domain 3 (Information Systems Acquisition, Development & Implementation) Subdomain A-2 (Business Case and Feasibility Analysis) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 3A-2 Business Case and Feasibility Analysis Practice Test 002

10 questions • Single best answer

Question 1

An external IS auditor engaged by a regional retail chain reviews the business case for a new omnichannel inventory platform. The case projects a 30% reduction in stockouts but provides no baseline stockout data, and the executive sponsor both authored the benefit estimates and recommended final approval. Which finding is MOST significant?

A. The business case does not quantify intangible benefits such as improved customer loyalty. B. Projected benefits cannot be validated and were not independently reviewed before approval. C. The stockout reduction target exceeds published benchmarks for similar retail implementations. D. The business case was not reviewed by the enterprise architecture review board.

Question 2

During a pre-approval review at a national insurance carrier, an IS auditor learns that the project team evaluated only one option for a new claims engine: a custom build. Management says off-the-shelf products were dismissed informally because of problems with vendors on earlier projects, and no comparison was documented. What should the IS auditor recommend FIRST?

A. Perform formal due diligence on the vendors involved in the earlier problem projects. B. Approve the custom build, provided that a detailed project risk register is maintained. C. Obtain a fixed-price development estimate to cap the cost of the custom build. D. Complete a documented analysis of alternatives, including buy and hybrid options.

Question 3

An audit manager at a public pension fund is assessing whether a proposed member self-service portal is financially feasible. The business case contains a net present value calculation prepared entirely by the IT department, showing a positive return over five years. Which of the following provides the BEST evidence that the underlying cost estimates are reliable?

A. Cost estimates reconciled to vendor quotes and validated by the finance function B. A signed attestation from the IT director confirming the accuracy of the estimates C. A comparison of the estimates with the portal budget approved in the prior year D. Steering committee minutes showing the estimates were discussed in detail

Question 4

A state revenue agency plans to deploy a real-time tax analytics system that must exchange data with a 25-year-old mainframe. The feasibility study analyzes financial and operational factors in depth, but its technical section relies only on a vendor statement that mainframe integration is fully supported. What is the IS auditor's BEST course of action?

A. Accept the vendor statement, because the vendor is contractually liable for integration. B. Recommend replacing the mainframe before the analytics system is approved. C. Recommend a proof of concept to validate integration before the investment decision. D. Report that the feasibility study is invalid and recommend cancelling the project.

Question 5

At a multinational manufacturer, the IS auditor finds that business cases for IT investments are prepared, approved, and later assessed for benefit realization entirely within the CIO's office. Business unit leaders receive and use the delivered systems but have no formal role in the investment decisions. Which recommendation is MOST appropriate?

A. Assign business sponsors accountability for the business case and for realizing its benefits. B. Require internal audit to approve each business case before funding is released. C. Establish a project management office to standardize the business case template. D. Have the CIO's office report benefit realization results to the audit committee each year.

Question 6

A logistics company's route-optimization project is 60% complete. A new regulation now requires data residency controls that will raise remaining costs by 40%, and one of the major expected benefits has already been delivered through a separate fleet-telematics initiative. Which action should the IS auditor recommend?

A. Continue the project, because most of the approved budget has already been spent. B. Reduce project scope so that total spending stays within the originally approved budget. C. Defer the regulatory controls to a later phase to protect the original timeline. D. Update the business case and resubmit it for a continue, modify, or stop decision.

Question 7

An IS auditor is planning a review of a commercial bank's IT investment approval process. Policy requires every project above $500,000 to have an approved business case supported by a feasibility study before funds are released. Which testing approach provides the BEST assurance that this policy is operating effectively?

A. Interview the portfolio manager about how business cases are reviewed and approved. B. Sample funded projects above the threshold and trace each to an approved business case. C. Review the business case template to confirm it contains the required feasibility sections. D. Sample approved business cases and verify that each includes a feasibility study.

Question 8

A hospital system's business case for a cloud-based patient scheduling application compares the first-year subscription fee with the annual cost of running its current on-premises system. The comparison shows a favorable return, and the steering committee intends to approve the investment at its next meeting. Which concern should the IS auditor raise with the committee FIRST?

A. The cloud provider may not meet the hospital's data backup and recovery requirements. B. The subscription fee has not been benchmarked against competing market offerings. C. The analysis omits multiyear total cost of ownership, including migration and integration. D. Committee members may lack the technical expertise needed to evaluate cloud solutions.

Question 9

During an audit of a university's student-information system project, the IS auditor determines that the approved business case overstated annual savings by counting staff reductions already claimed by a separate shared-services project. Development has not yet started, and the corrected savings may not justify the investment. What should the IS auditor do FIRST?

A. Include the finding in the audit report issued after the project is completed. B. Recalculate the savings and update the business case with the corrected figures. C. Notify the shared-services sponsor that its own benefit claim may be invalid. D. Communicate the finding promptly to the project sponsor and the approving body.

Question 10

A property and casualty insurer's business case for an AI-driven underwriting tool projects large savings from fully automating policy approval decisions. The feasibility study covers costs and technical architecture, but compliance staff were not consulted, and regulators in two key markets restrict fully automated decisions affecting consumers. Which gap is MOST significant?

A. Legal and regulatory feasibility was not assessed, which may prevent the benefits from being realized. B. The study does not compare the AI tool with alternative rules-based underwriting engines on cost. C. Model accuracy metrics were not defined as key performance indicators in the business case. D. The technical architecture does not describe how the model will be retrained and monitored.

Related Posts

Leave a Comment Cancel Reply