It is important for an IS auditor to review the information systems acquisition, development, and implementation process to ensure that it has been performed properly and that any errors or issues have been identified and addressed. A lessons-learned exercise is an important part of this process, as it allows for the identification and rectification of any issues that may have been missed during the initial stages of the process. Without this exercise, any potential issues may go unnoticed and lead to further problems down the line.

Having multiple vendors without NDAs can lead to unauthorized access to sensitive information, which could lead to a security breach. NDAs also help to ensure that the vendors are providing quality services and not cutting corners.