Information Systems Acquisition and Development

A CISA aspirant should have a sound understanding of information system acquisition, development, and implementation processes. You should be able to understand how an organization evaluates, develops, implements, maintains, and disposes of its information systems and related components.

The following topics will be covered in this chapter:

• Project management structure
• Business case and feasibility analysis
• System development methodologies
• Control identification and design

You will now explore each of these in detail.

Project Management Structure

Project management structure can be primarily classified into the following three categories:

Functional Structured	Project Structure	Matrix Structured
The project manager has no authority. The project manager only advises peers on projects.	The project manager has formal authority on budget, schedules, and team members of the project.	Authority is shared between project manager and department heads.

Table 5.1: Categories of project management

For all the preceding project structures, the project should be approved and prioritized by the IT steering committee. A person in charge of the project must be appointed and should be made responsible for project execution. This project manager should be given the relevant resources and infrastructure to ensure the...

Business Case and Feasibility Analysis

It is very important to consider the business case and feasibility analysis before undertaking any new project. The IS auditor should have a basic understanding of the business case as well as the feasibility study.

Business Cases

A business case is a justification for a proposed project. The business case is prepared to justify the effort and investment in a proposed project and captures the reasoning for initiating a project or task. Generally, the business case is the precursor to the start of the project. It is a key element in decision-making for any project. The project sponsor is responsible for developing the business case.

The proposed return on investments (ROI)s, along with any other expected benefits, are the most important consideration for decision-making in any new project.

Feasibility Analysis

A feasibility study is an analysis that takes various factors into account, including economic, technical, and legal factors...

System Development Methodologies

A system development methodology is a structure that organizations use for the design, development, and implementation of new systems. Different methodologies are available, with each of them having different characteristics. In this section, you will learn about the following concepts:

• SDLC models
• SDLC phases
• Software development methods

SDLC Models

Three widely used SDLC models are the traditional waterfall, the V-shaped model, and the iterative model. The following sections present each of them in detail.

Traditional Waterfall

This model aims to ensure that mistakes are identified at an early stage and not during final acceptance testing. The significant features of this method are as follows:

• The waterfall method is the most commonly adopted approach for developing business applications.
• It works well when requirements are well defined and do not undergo frequent changes.
• This approach is useful when...

Control Identification and Design

An IS auditor needs to have a sufficient understanding of the various control techniques used while designing applications. In the next few sub-sections, you will go through some of the important controls built into an application system.

Check Digits

A check digit is an extra digit used for error detection. A check digit is arrived at by a mathematical algorithm. It is added to the original data to ensure that data is not altered.

By ensuring that the original data is not tampered with or altered, check digits help prevent transposition and transcription errors. The most widely used example of the use of a check digit is the bank account numbers assigned to customers.

For instance, suppose a bank account number is 630000241453. The last digit, 3, is the check digit, and if the other numbers are correct, then the check digit calculation will produce 3:

1. Add the numbers placed in odd digit positions: 6+0+0+2+1+5 = 14.
2. Add the...

Summary

In this chapter, you gained an understanding of project management structure and methodologies. You also learned about the importance of business case and feasibility studies. Additionally, you explored some important system-related controls such as check digits, parity bits, checksums, and principles of data integrity.

The following are the important topics covered in this chapter:

• PERT is a technique for estimating project duration. PERT is considered more accurate and appropriate compared to CPM for estimations of project duration. Gantt charts are primarily used to monitor the progress of the project. SLOC and FPA are techniques to estimate software size.
• The business case is a justification for the proposed project. It is prepared to justify the effort and investment in a proposed project and is a precursor to the start of the project. The first concern of an IS auditor is whether the new project meets the needs of the business. This should be established...

Chapter Review Questions

Before you proceed to Chapter 6, Information Systems Implementation, it is recommended that you solve the practice questions from this chapter first. These chapter review questions have been carefully crafted to reinforce the knowledge you have gained throughout this chapter. By engaging with these questions, you will solidify your understanding of key topics, identify areas that require further study, and build your confidence before moving on to new concepts in the next chapter.

Note

A few of the questions may not be directly related to the topics in the chapter. They aim to test your general understanding of information systems concepts instead.

The following image shows an example of the practice questions interface.

Figure 5.4: CISA practice question interface

To access the end-of-chapter questions from this chapter, follow these steps:

1. Open your web browser and go to https://packt.link/yKHnk. You will see...

The rest of the chapter is locked

Business Case and Feasibility Analysis

It is very important to consider the business case and feasibility analysis before undertaking any new project. The IS auditor should have a basic understanding of the business case as well as the feasibility study.

Business Cases

A business case is a justification for a proposed project. The business case is prepared to justify the effort and investment in a proposed project and captures the reasoning for initiating a project or task. Generally, the business case is the precursor to the start of the project. It is a key element in decision-making for any project. The project sponsor is responsible for developing the business case.

The proposed return on investments (ROI)s, along with any other expected benefits, are the most important consideration for decision-making in any new project.

Feasibility Analysis

A feasibility study is an analysis that takes various factors into account, including economic, technical, and legal factors...

System Development Methodologies

A system development methodology is a structure that organizations use for the design, development, and implementation of new systems. Different methodologies are available, with each of them having different characteristics. In this section, you will learn about the following concepts:

• SDLC models
• SDLC phases
• Software development methods

SDLC Models

Three widely used SDLC models are the traditional waterfall, the V-shaped model, and the iterative model. The following sections present each of them in detail.

Traditional Waterfall

This model aims to ensure that mistakes are identified at an early stage and not during final acceptance testing. The significant features of this method are as follows:

• The waterfall method is the most commonly adopted approach for developing business applications.
• It works well when requirements are well defined and do not undergo frequent changes.
• This approach is useful when...

Control Identification and Design

An IS auditor needs to have a sufficient understanding of the various control techniques used while designing applications. In the next few sub-sections, you will go through some of the important controls built into an application system.

Check Digits

A check digit is an extra digit used for error detection. A check digit is arrived at by a mathematical algorithm. It is added to the original data to ensure that data is not altered.

By ensuring that the original data is not tampered with or altered, check digits help prevent transposition and transcription errors. The most widely used example of the use of a check digit is the bank account numbers assigned to customers.

For instance, suppose a bank account number is 630000241453. The last digit, 3, is the check digit, and if the other numbers are correct, then the check digit calculation will produce 3:

1. Add the numbers placed in odd digit positions: 6+0+0+2+1+5 = 14.
2. Add the...

Summary

In this chapter, you gained an understanding of project management structure and methodologies. You also learned about the importance of business case and feasibility studies. Additionally, you explored some important system-related controls such as check digits, parity bits, checksums, and principles of data integrity.

The following are the important topics covered in this chapter:

• PERT is a technique for estimating project duration. PERT is considered more accurate and appropriate compared to CPM for estimations of project duration. Gantt charts are primarily used to monitor the progress of the project. SLOC and FPA are techniques to estimate software size.
• The business case is a justification for the proposed project. It is prepared to justify the effort and investment in a proposed project and is a precursor to the start of the project. The first concern of an IS auditor is whether the new project meets the needs of the business. This should be established...

Chapter Review Questions

Before you proceed to Chapter 6, Information Systems Implementation, it is recommended that you solve the practice questions from this chapter first. These chapter review questions have been carefully crafted to reinforce the knowledge you have gained throughout this chapter. By engaging with these questions, you will solidify your understanding of key topics, identify areas that require further study, and build your confidence before moving on to new concepts in the next chapter.

Note

A few of the questions may not be directly related to the topics in the chapter. They aim to test your general understanding of information systems concepts instead.

The following image shows an example of the practice questions interface.

Figure 5.4: CISA practice question interface

To access the end-of-chapter questions from this chapter, follow these steps:

1. Open your web browser and go to https://packt.link/yKHnk. You will see...