Which SDLC Quality Elements Must an IS Auditor Review?
Short answer
C Validate that system development processes adhere to quality standards during the SDLC review.
Question
Key Takeaways
Tests the distinction between developer implementation and auditor verification, highlighting the common trap of selecting utilization over validation.
This CISA question tests the core responsibility of an IS auditor reviewing the SDLC, establishing that validating adherence to quality standards is mandatory. The page clarifies why verification trumps mere utilization during an audit.
Common mistake: Option B is frequently selected because it describes a legitimate development activity, but auditors do not utilize standards; they assess compliance against them.
Expert Analysis
Why the Answer Is Correct
An IS auditor’s primary objective during an SDLC review is to provide independent assurance that controls function as intended. Option C correctly identifies validation as the mandatory audit activity because auditors must verify that development teams actually follow established quality frameworks like ISO 9001 or CMMI. Without explicit validation, the organization cannot confirm that software defects are minimized or that deliverables meet business requirements.
Why the Other Options Are Wrong
Option A focuses on ownership, which is a governance and management responsibility rather than a direct audit testing procedure. Option B describes how developers should work, but the auditor’s role is to evaluate whether those standards were applied, not to apply them. Option D belongs to the project planning phase where stakeholders define success criteria, making it irrelevant to the retrospective audit review process.
Community Comment Notes
Learners consistently recognize validation as the core audit function, with several noting that reviewers must ensure processes follow established quality benchmarks. One candidate noted they were "torn between B and C", seeking evidence to differentiate them. The distinction lies in role separation: developers implement and utilize standards, while auditors independently validate adherence. As multiple users confirmed, confirming compliance at each lifecycle stage remains the definitive audit requirement.
Exam Strategy
When answering SDLC audit questions, always distinguish between what the development team executes versus what the auditor verifies. Look for keywords like validate, assess, or review to identify the auditor's actual responsibility and avoid confusing operational tasks with assurance activities.
Frequently Asked Questions
Why isn't utilizing standards the auditor's duty?
Does defining quality attributes belong in the SDLC audit?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
46080f2 👍 1 Answered CAn IS auditor reviewing an organization’s SDLC must validate that development processes adhere to established quality standards. This involves verifying compliance with documented procedures at each phase of the lifecycle, such as design specifications, testing protocols, and post-implementation controls12. For example, auditors assess whether design documents align with institutional standards, whether testing follows approved methodologies, and whether changes are properly authorized13. While utilization of standards (B) is important, the audit’s critical function is validation (C) to ensure actual adherence rather than mere existence of standards. Quality attributes (D) and ownership details (A) are context-dependent considerations rather than universal requirements for every SDLC review.
-
Cisagroup 👍 1 Answered CWhen reviewing an organization’s System Development Life Cycle (SDLC), an IS auditor must ensure that system development processes follow established quality standards (e.g., ISO 9001, CMMI, ITIL, COBIT)
-
blehbleh 👍 1I am torn between B and C. If someone can explain why one is correct with evidence that would be helpful.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISA Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISA Practice Test →