| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
Business Case & Feasibility Analysis
This episode of the ISACA Certified Information Systems Auditor (CISA) exam prep series introduces how organizations justify and validate IT projects before committing resources, covering the purpose of the business case, the role of stage gates, and the structured examination carried out in a feasibility study. These skills help auditors keep project decisions evidence-based and protect the organization from poor spending.
What this episode covers
- Business case purpose — why it gates a project and why it must remain valid throughout the project life, not just at initiation.
- Stage gates and kill points — how decision points let sponsors recheck the business case and stop projects that no longer make sense.
- Project scope — defining the business problem or opportunity tightly before any work begins.
- Current analysis and requirements — assessing the existing system and specifying what the new solution must do, including regulatory and security needs.
- Approach and evaluation — weighing build versus buy, comparing options, and calculating cost-effectiveness including return on investment.
- Stakeholder review — the formal approval, rejection, or revision step that closes the feasibility study.
- Auditor review checklist — the key questions an IS auditor asks when examining a feasibility study for completeness and bias.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What is a business case and why does it act as a gate for a project?
A business case carries the information needed to decide whether to proceed with a project by answering why the organization should undertake or continue it. It describes the business reasons and expected benefits and should remain valid across the whole life of the project. Good projects build in stage gates, also called kill points, where the case is re-examined; if it no longer holds, sponsors should pause and reconsider.
What are the six parts of a feasibility study?
The six parts are project scope, which defines the business problem or opportunity; current analysis, which assesses the existing system; requirements, which specify what the solution must do; approach, which sets the chosen course of action and explains the build-versus-buy decision; evaluation, which examines cost-effectiveness including return on investment; and review, where stakeholders formally approve or reject the study.
What should an auditor check when reviewing a feasibility study?
An auditor should confirm that requirements are critical, accurate, and complete, and that all affected user groups were represented. The auditor should verify that alternatives were judged fairly, every cost and benefit is real and traceable, and the high-level design defines adequate controls. If the enterprise consistently misses its return targets, that often signals weak development and project practices worth investigating further.
How does the evaluation section of a feasibility study support the go or no-go decision?
The evaluation examines whether the project is cost-effective by comparing costs across all options, including employee hours, materials, and vendor costs. It lists the schedule and a cost-benefit summary, and return on investment appears here as a key decision input. The final review then sees stakeholders approve, reject, or return the study for revision based on this evidence.
📚 Master the ISACA CISA Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISACA CISA certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in Business Case & Feasibility Analysis.