Exam CISA topic 1 question 22 discussion

D. The business case.

B , An IS auditor's primary role is to validate that assets are protected based on their classification, ensuring alignment with security measures.

The most critical aspect for an IS auditor to review when evaluating whether the expected benefits of a project have been achieved is the business case (option D). The business case outlines the rationale for the project, including its expected benefits, costs, and risks. By comparing the actual outcomes against the projected benefits laid out in the business case, the IS auditor can effectively assess the success of the project. While post-implementation issues (option C) are important to address, they are typically considered in conjunction with the business case evaluation to determine if any deviations or unexpected challenges impacted the project's outcomes.

business case

Needs to be C. During the post-implementation review, cost-benefit analysis and ROI should be performed to verify that the original business case benefits are delivered

chat GPT is saying POST IMPLEMENTATION issues how can we be sure of the response plz

Quality assurance results are like IT checklists can be incorrect, maybe they are generic or unrelated. As IS auditor we need to understand business case first and validate QA results are correct or maybe develop our own checklist or test cases.

d is answer

Quality Assurance will ensure that users' requirements has been met in the new project, not the business cased

I suppose post implementation review verifies if the benefits stated in the business case were achieved. Review of business case is one of the key activities during PIR to show that project's benefits are achieved. So I think the examiner is right.

Why not look at the post implemetation