Most Important RFP Requirement for Application Acquisition?

Vendor Management / Procurement Controls

Answer Correct answer: D — Requesting the vendor’s system development methodology in the RFP ensures their delivery processes align with organizational security and quality standards.

When reviewing the acquisition for a new application, which of the following is MOST important to ensure was included in the request for proposal (RFP) process?

User acceptance testing (UAT) plan
Vendor financial stability
Vendor key performance indicators (KPIs)
System development methodology Correct Answer

cisa rfp evaluation criteria vendor management cisa system development methodology audit application acquisition controls

Community Votes

60%

20%

60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests whether you distinguish between pre-award RFP evaluation criteria and post-award project activities, highlighting the trap of selecting user acceptance testing instead of development methodology.

This CISA question evaluates your understanding of critical procurement controls during the vendor selection phase. The page establishes that requesting the vendor’s system development methodology is essential to assess delivery quality and risk before contract signing.

Many candidates incorrectly choose UAT because it sounds like a validation step, but UAT occurs after vendor selection and implementation, making it irrelevant to the RFP evaluation process.

Community Discussion (4 comments)

46080f2 👍 1 Selected: B

The most important factor to ensure was included in the request for proposal (RFP) process when acquiring a new application is B. Vendor financial stability. Ensuring the vendor's financial stability helps mitigate the risk of the vendor going out of business, which could jeopardize the support and future updates for the application

blehbleh 👍 2 Selected: A

Hayati, you are killing me, you voting and saying "Why not (answer)" adds zero value to the conversation. Regardless in this case I agree it is A. The reason being if there is not user acceptance testing then you can not ensure or validate that it meets the user requirements and needs. The RFP should include user acceptance testing.

Vima234 👍 1 Selected: D

System development methodology Including the system development methodology in the RFP process is essential because it helps evaluate the vendor's approach to developing and delivering the application. Understanding the methodology ensures that the project aligns with the organization’s expectations for quality, timelines, and collaboration. It also helps determine whether the vendor's processes are compatible with the organization’s needs, such as agile, waterfall, or other methods. A. User acceptance testing (UAT) plan can be important but is generally more relevant in later stages of the project, not at the RFP stage. B. Vendor financial stability is often evaluated through due diligence after selecting a vendor but may not be explicitly detailed in the RFP. C. Vendor KPIs are useful for performance monitoring post-implementation but are less relevant at the RFP stage.

Hayati 👍 1 Selected: A

Why not A

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

System development methodology (D) must be explicitly requested in the RFP to evaluate how the vendor plans to design, code, test, and deploy the application. ISACA emphasizes that assessing the vendor’s SDLC approach ensures alignment with organizational security, quality, and compliance standards before a contract is signed. Without this requirement, auditors cannot verify that the solution will be delivered reliably or securely.

Why the Other Options Are Wrong

UAT (A) is a client-led validation activity conducted after the vendor delivers the application, not a vendor capability evaluated during procurement. Vendor financial stability (B) is verified through independent credit reports and due diligence, not submitted as part of the technical RFP response. KPIs (C) belong in service level agreements and post-implementation contracts rather than the initial RFP evaluation phase.

Community Comment Notes

Several learners initially prioritized UAT, mistakenly treating post-deployment validation as a pre-contract requirement. As blehbleh noted, focusing solely on testing ignores the broader procurement lifecycle. Other contributors correctly identified that financial vetting and KPI tracking belong to separate due diligence and contractual phases. This consensus highlights why technical delivery processes take precedence during RFP evaluation.

Exam Strategy

Always map each option to the project lifecycle phase described in the question. If the scenario focuses on procurement or RFP evaluation, prioritize criteria that assess vendor capability and process maturity over execution-phase activities like testing or reporting.

Frequently Asked Questions

Why isn't UAT required in the RFP?

UAT is a client-led validation phase executed after the vendor delivers the application, not a vendor capability evaluated during procurement.

Should vendor financial stability be in the RFP?

Financial health is verified through independent credit reports and due diligence, not submitted as part of the technical RFP response.

Related Analysis

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide