Which Business Case Component Best Indicates Vendor Due Diligence?

CISA By islever Editorial Last updated Sep 9, 2026

Short answer

C Documenting alternative solutions proves thorough vendor due diligence by showing multiple options were systematically evaluated before selection.

Question

Which component of a business case provides the BEST indication that due diligence was performed during the vendor selection process?

Management approval
Problem statement
Alternative solutions Correct Answer
Cost-benefit analysis

Key Takeaways

Tests understanding of business case components in vendor selection, with the common trap being confusing financial justification (cost-benefit) with comprehensive due diligence (alternative evaluation).

Evaluating vendor alternatives is a critical step in IT audit due diligence. This guide establishes why alternative solutions outperform cost-benefit analysis as the best indicator of thorough vendor selection.

Common mistake: Option D (Cost-benefit analysis) is frequently chosen because it appears financially rigorous, but it only validates the final choice rather than proving the full comparative research required for due diligence.

Expert Analysis

Why the Answer Is Correct

Evaluating alternative solutions is the strongest indicator of due diligence because it proves the organization systematically researched and compared multiple vendors against defined criteria. ISACA audit standards require decision-makers to document how various options stack up technically, operationally, and financially before recommending a path forward. This comparative documentation directly reflects the thoroughness expected in a formal vendor selection process. Without analyzing alternatives, a business case cannot demonstrate that the chosen vendor was truly vetted rather than arbitrarily selected.

Why the Other Options Are Wrong

Management approval merely authorizes the proposal and offers no insight into the research phase behind it. A problem statement clearly defines the business need but stops short of proving that external options were actually investigated. Cost-benefit analysis quantifies the financial viability of the recommended choice, yet it assumes alternatives were already identified. Relying solely on financial metrics validates the final decision rather than proving the comprehensive preparatory work that defines due diligence.

Community Comment Notes

Many learners initially lean toward financial validation, but experienced candidates recognize that comparing multiple options covers broader risk and operational factors. As one contributor noted, this approach "implies the consideration and comparison of different vendors or solutions" across several dimensions. Others clarify that while financial justification supports the final recommendation, it does not replace the foundational research required to prove thorough preparation. The consensus reinforces that comprehensive option analysis is the definitive audit trail for due diligence.

Exam Strategy

When answering CISA questions about due diligence, prioritize options that demonstrate systematic evaluation and comparison over those that only validate a single choice. Look for keywords like "alternatives," "options," or "comparative analysis" when the question emphasizes thorough preparation or risk assessment.

Frequently Asked Questions

Why isn't cost-benefit analysis the best indicator?

Cost-benefit analysis only quantifies financial viability for the chosen option. It does not prove that other vendors were researched and compared, which is the true essence of due diligence.

How does ISACA define due diligence in vendor selection?

ISACA expects auditors to verify that organizations systematically evaluate multiple alternatives against technical, security, and operational criteria before committing resources.

More CISA FAQ →

Community Votes

56%

44%

56% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Swallows 👍 4 Answered D

A cost-benefit analysis is the component of a business case that provides the best indication that due diligence was performed during the vendor selection process.
4dfe785 👍 2 Answered C

Both C. Alternative solutions and D. Cost-benefit analysis are important components indicating due diligence. However, the alternative solutions component tends to provide a broader view of the due diligence process as it implies the consideration and comparison of different vendors or solutions, addressing multiple factors (financial, technical, operational) rather than just the financial perspective.
blehbleh 👍 2 Answered C

I am leaning toward C with 4dfe, this shows that true due diligence went into consideration.
maxson69 👍 1 Answered C

While D is important for justifying the chosen solution, C best demonstrates that the organization performed due diligence by considering and comparing multiple options during the vendor selection process.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide