Ensuring Project Plan Adherence in IS Auditing

CISA By islever Editorial Last updated Sep 7, 2026

Short answer

A Conduct compliance audits at major system milestones.

Question

The BEST way to provide assurance that a project is adhering to the project plan is to:

conduct compliance audits at major system milestones. Correct Answer
require design reviews at appropriate points in the life cycle.
have an IS auditor participate on the quality assurance (QA) team.
have an IS auditor participate on the steering committee.

Key Takeaways

This question tests the distinction between continuous monitoring (design reviews) and formal assurance events (milestone audits), highlighting that milestone audits provide comprehensive verification of overall progress.

The most effective method for providing assurance that a project adheres to its plan is conducting compliance audits at major milestones, as confirmed by community consensus and expert analysis.

Common mistake: Candidates often choose design reviews (B), assuming that frequent checks are better, but this misses the broader scope of verifying total adherence to the plan at critical junctures.

Expert Analysis

Why the Answer Is Correct

Conducting compliance audits at major system milestones (Option A) provides structured, independent evaluation points where the entire project's status can be measured against the baseline plan. This approach ensures that significant deviations are identified early enough to allow for corrective action before they become systemic failures.

Why the Other Options Are Wrong

Design reviews (Option B) focus specifically on technical specifications rather than overall project plan adherence. Having an auditor on the QA team (Option C) compromises independence, as they become part of the operational process rather than an objective evaluator. Participation in the steering committee (Option D) offers governance oversight but lacks the specific audit mechanisms needed to verify plan adherence directly.

Community Comment Notes

Comment [1] highlights that milestone audits offer a systematic evaluation of adherence. Comment [4] reinforces that while design reviews are important, milestone audits are more comprehensive for verifying overall progress. Comment [3] represents the common trap of choosing continuous review over formal assurance checkpoints.

Official Reference

https://www.isaca.org/resources/isaca-journal/past-issues/2015/volume-6/auditing-it-projects

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about 'assurance' or 'verification' of adherence, look for options involving formal audits or reviews at defined intervals rather than ongoing operational tasks. Independence and comprehensiveness are key criteria in ISACA questions regarding audit activities.

Frequently Asked Questions

Why not design reviews for plan adherence?

Design reviews check technical specs, not overall project plan adherence like schedule or budget.

Is an auditor on the QA team independent?

No, it compromises independence as they become part of the operational quality assurance process.

More CISA FAQ →

Community Votes

66%

34%

66% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

MJORGER 👍 3 Answered A

A. conduct compliance audits at major system milestones. Compliance audits at major system milestones provide a structured, systematic, and independent evaluation of the project’s adherence to the project plan.
joehong 👍 1 Answered C

Option A, which suggests conducting compliance audits at major system milestones, is indeed important. However, it is not the most effective method for ongoing assurance that a project is adhering to the project plan. Compliance audits are typically conducted at specific points in time and may not capture issues that arise between these milestones. On the other hand, having an IS auditor participate on the quality assurance (QA) team (Option C) allows for continuous oversight and real-time monitoring of the project’s adherence to the project plan. This proactive approach can identify and correct deviations more promptly and ensure that the project stays aligned with its intended trajectory throughout its lifecycle.
Swallows 👍 1 Answered A

While design reviews are an important element, rather than focusing on evaluation at the design stage, compliance audits at key system milestones are more comprehensive and effective in terms of verifying overall project progress and adherence to plan.
Swallows 👍 1 Answered B

I came to the conclusion that the answer was B, not A. By conducting regular design reviews, we could check the consistency with the plan at each stage of the project and make corrections early if necessary.
RS66 👍 1 Answered B

B. require design reviews at appropriate points in the life cycle.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide