ISACA Certified Information Systems Auditor (CISA) ExamDomain 1: Information System Auditing ProcessMedium
An IS auditor is conducting a post-implementation review of a new financial reporting system. The project utilized an agile development methodology. What is the MOST critical aspect for the IS auditor to verify regarding system documentation in an agile environment?
- AFormal sign-offs for each development phase are obtained from all stakeholders.
- BExtensive technical diagrams for all system modules are updated weekly.
- CUser stories and acceptance criteria are traceable to delivered functionality.
- DComprehensive, detailed design specifications are finalized before coding begins.
Show answer & explanationAnswer & explanation
Correct answer: C. User stories and acceptance criteria are traceable to delivered functionality.
In an agile environment, documentation is typically lean and focused on supporting functionality. Traceability from user stories (requirements) to delivered functionality and their acceptance criteria ensures that the system meets business needs and that development aligned with documented requirements.
Why the other options are wrong
- A. Formal sign-offs for each phase are more common in traditional methodologies; agile emphasizes continuous collaboration and feedback over rigid phase gates.
- B. Extensive, weekly updated technical diagrams might be overly burdensome and not aligned with agile's 'just enough' documentation principle.
- D. Comprehensive upfront design is characteristic of waterfall, not agile, where design evolves iteratively.
Agile Documentation
Agile documentation focuses on creating 'just enough' documentation to support development, maintainability, and user understanding, prioritizing working software over comprehensive documentation.
- Emphasizes user stories, acceptance criteria, and living documentation.
- Documentation evolves with the product.
- Focuses on value and fitness for purpose.
Memory trick: Agile: Adapt, Grow, Iterate, Lean, Evolve.