ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is reviewing the requirements gathering process for a new enterprise content management (ECM) system. The project team, adopting an agile approach, has conducted several workshops with key stakeholders. To ensure that the gathered requirements are complete and accurately reflect business needs, which of the following is the MOST effective technique?
- AConducting one-on-one interviews with senior management to prioritize requirements.
- BCreating detailed use cases and user stories and having stakeholders review and approve them.
- CBenchmarking requirements against industry best practices for similar systems.
- DDistributing formal questionnaires to all potential end-users for feedback.
Show answer & explanationAnswer & explanation
Correct answer: B. Creating detailed use cases and user stories and having stakeholders review and approve them.
In an Agile context, use cases and user stories provide clear, concise descriptions of system functionality from the user's perspective. Having stakeholders review and approve these ensures that the requirements are understood, complete, and accurately reflect their needs.
Why the other options are wrong
- A. While senior management input is crucial for prioritization, it doesn't replace the detailed validation of functional requirements by the actual end-users and business process owners.
- C. Benchmarking provides valuable input but does not directly confirm that the specific gathered requirements meet the unique needs of the organization's stakeholders.
- D. Questionnaires can gather broad input but may lack the depth and collaborative refinement needed to fully capture and validate complex requirements.
Agile Requirements Validation
The process of continually confirming that gathered requirements accurately reflect stakeholder needs and are understood by the development team in an Agile environment.
- Uses artifacts like user stories and use cases.
- Involves continuous stakeholder feedback and collaboration.
- Ensures requirements are clear, testable, and aligned with business value.
Memory trick: For agile accuracy, stories and cases, then stakeholder faces.