ISACA CISA: Systems Acquisition, Operations, and Resilience

Two CISA domains meet at the point where a project becomes an operating system. Information Systems Acquisition, Development and Implementation represents 12% of the current exam, while Information Systems Operations and Business Resilience represents 26%. ISACA separates them in the blueprint, but real audit failures often occur in the handoff between the two.

A system can be delivered on time and still be unready for production because monitoring, ownership, recovery, capacity, support, access, or data-conversion controls were never completed. The auditor’s job is to test whether management has enough reliable evidence to say the system is ready and remains controlled after launch.

Begin with project governance, not technical detail

Before evaluating a development method or a migration script, establish who owns the business outcome, who approves scope and risk, how changes are governed, and whether the project has measurable acceptance criteria. A technically elegant implementation can still be a control failure if there is no accountable decision maker.

For exam scenarios, separate management responsibility from audit responsibility. The auditor evaluates governance, evidence, and control effectiveness. The auditor should not become the person who designs the control and then audits the same design.

Business cases should survive contact with implementation

A business case is more than a funding document. It establishes why the organization is taking the risk of change. During audit, compare the promised benefits, costs, dependencies, and risks with what the project actually delivered.

If a system requires expensive manual reconciliation that was never included in the business case, or if a control requirement was deferred without approved risk acceptance, the project may be technically complete but not economically or operationally sound.

Control design belongs inside the development life cycle

Controls added after build are often expensive and incomplete. Access segregation, input validation, audit logging, approval workflow, data retention, privacy, interface controls, and exception handling should be considered while requirements are being defined.

The CISA perspective is to ask whether the control objective is clear, whether the design addresses the risk, and whether testing demonstrates that the control works under realistic conditions. “The feature exists” is weaker evidence than a traceable requirement, test result, defect disposition, and approval.

Readiness testing must cover the operating model

User acceptance testing is important, but production readiness is broader. The organization also needs support procedures, monitoring, incident ownership, security configuration, backup and recovery, capacity expectations, runbooks, training, and escalation paths.

A useful audit question is: if the implementation team disappeared tomorrow, could operations run and recover the service using the approved documentation and tools? If the answer is no, readiness may be overstated.

Migration controls protect completeness and accuracy

Data conversion is a classic examination topic because it combines technical and business evidence. Auditors should look for defined reconciliation criteria, controlled transformation rules, exception handling, approvals, and proof that the target population is complete and accurate.

Do not accept record counts alone when critical fields can be corrupted while the count remains unchanged. Reconciliation should match the risk: totals, control totals, samples, field-level validation, duplicate detection, and exception review may all be relevant.

Change and release management connect implementation to operations

The moment a release enters production, the control objective changes from “build the right thing” to “change the live service predictably.” Authorization, testing, segregation of duties, deployment evidence, rollback planning, and post-change validation become central.

Emergency change procedures should not mean “skip the controls.” They should define a faster but still accountable path, with appropriate retrospective review. A recurring stream of emergencies can itself be evidence of weak planning or release discipline.

Operations should make system health observable

Domain 4 includes availability and capacity management, incident and problem management, change and configuration management, operational logging, service levels, databases, interfaces, and production automation. The common theme is evidence.

A mature operation can explain what normal service looks like, how degradation is detected, who responds, how root cause is distinguished from symptom, and how repeated incidents feed back into improvement. Dashboards are not enough if alerts are ignored or thresholds do not match business impact.

Business resilience starts with impact, not technology

Business-impact analysis identifies which processes matter, how quickly they must recover, which resources they depend on, and what level of data loss is tolerable. Recovery technology should follow those requirements.

For CISA questions, distinguish recovery time from recovery point. A service may need to return quickly but tolerate some data loss, or it may tolerate a longer outage but require near-zero data loss. The right architecture depends on the business requirement, not on which backup product is available.

Backups are controls only when restoration is credible

A successful backup job proves that data was copied. It does not prove that the organization can restore the right data, within the required time, into a usable service. Auditors should look for restoration testing, protected backup credentials, appropriate retention, off-site or logically isolated copies where risk requires them, and evidence that failed jobs are investigated.

Scenario: a new finance platform is ready to launch

Suppose management wants to go live Friday night. Functional testing passed, but the disaster-recovery environment has never been restored from production-like data and operations has not completed its runbook. The strongest audit concern is not that the project team used the wrong development method. It is that production readiness and resilience evidence are incomplete.

The response should focus on the risk and the missing evidence. Management owns the go-live decision. The auditor reports whether the organization’s defined readiness and risk-acceptance process has been satisfied.

Scenario: a migration reconciles record counts but not balances

A legacy system contains one million customer records and the new system contains the same number. That alone does not establish data integrity. If monetary balances or status codes were transformed incorrectly, the count can still match.

The better evidence combines completeness and accuracy: control totals, field validation, exception reports, business-owner review, and documented resolution of conversion errors.

Scenario: incidents keep recurring after every release

Repeated incidents immediately after releases suggest a process weakness rather than a series of unrelated operational events. The auditor should trace change approval, testing, deployment, configuration management, rollback, and post-implementation review to find where the control is failing.

That is the connection between Domains 3 and 4: weak implementation becomes operational risk, and operational evidence should feed back into the next implementation cycle.

Build readiness around evidence

The CISA readiness framework is most useful when you can explain what evidence you would request, why it matters, and what conclusion it supports. Use CISA practice questions to rehearse that decision process across mixed scenarios.

For these two domains, memorize fewer procedures and practice more handoffs. Ask whether governance survives development, whether controls survive migration, whether operations can prove service health, and whether recovery capabilities satisfy actual business requirements. That is the audit judgment the current CISA blueprint is designed to test.