Certified Information Systems Auditor (CISA) — Question 165

During a project assessment, an IS auditor finds that business owners have been removed from the project initiation phase. Which of the following should be the auditor’s GREATEST concern with this situation?

Answer options

• A. Incomplete requirements
• B. Inadequate deliverables
• C. Unclear benefits
• D. Unrealistic milestones

Correct answer: A

Explanation

The auditor's greatest concern should be incomplete requirements, as the absence of business owners from the initiation phase can lead to missing critical input that defines what the project needs to achieve. Without proper requirements, the project may face challenges in meeting stakeholders' expectations, while inadequate deliverables, unclear benefits, and unrealistic milestones can be symptoms of the primary issue rather than the core concern.