CISA - Certified Information Systems Auditor IT Governance and Strategy Questions and Answers — Questions and Answers
Question 1: An IS auditor is reviewing an organization's IT strategic planning process. Which of the following is the MOST crucial for ensuring the alignment of the IT strategy with the business strategy?
- The IT strategic plan is reviewed and approved by the IT department's senior management.
- The IT strategic plan is primarily driven by the latest technological innovations.
- The IT steering committee is composed of representatives from key business functions and IT. (Correct answer)
- The IT budget is allocated based on the previous year's expenditures.
Correct answer: The IT steering committee is composed of representatives from key business functions and IT.
The primary role of an IT steering committee is to ensure that IT activities are aligned with business objectives. By having representation from key business functions, the committee can ensure that IT plans, projects, and investments support the overall goals of the enterprise. [2, 3]
Question 2: During a review of IT governance, an IS auditor finds that there is no formal IT risk management program. Which of the following represents the GREATEST risk to the organization?
- Increased cost of technology procurement.
- The organization's risk appetite may be exceeded without senior management's awareness. (Correct answer)
- IT projects may not be completed on time.
- The IT department may not be able to attract skilled personnel.
Correct answer: The organization's risk appetite may be exceeded without senior management's awareness.
A formal IT risk management program is essential for identifying, assessing, and mitigating risks. Without it, the organization may unknowingly accept a level of risk that is higher than what senior management has deemed acceptable (the risk appetite), potentially leading to significant business impact. [30, 34]
Question 3: Which of the following is the PRIMARY purpose of implementing an IT balanced scorecard?
- To exclusively measure the financial return on IT investments.
- To benchmark IT performance against competitor organizations.
- To translate IT strategy into measurable objectives and monitor its performance. [5] (Correct answer)
- To justify the IT department's annual budget requests.
Correct answer: To translate IT strategy into measurable objectives and monitor its performance. [5]
The IT balanced scorecard is a strategic management tool used to translate the IT strategy into a comprehensive set of performance measures. It provides a balanced view by measuring performance from different perspectives, such as customer satisfaction, internal processes, and innovation, not just financial outcomes. [4, 23]
Question 4: An organization has recently decided to outsource its data center operations to a third-party provider. From an IT governance perspective, what is the MOST important responsibility that remains with the organization's management?
- Performing daily backups of the outsourced systems.
- Defining the detailed technical specifications for the provider's hardware.
- Training the third-party provider's staff on internal procedures.
- Overall accountability for the security and privacy of the organization's data. (Correct answer)
Correct answer: Overall accountability for the security and privacy of the organization's data.
While operational tasks can be delegated to a third party, the ultimate accountability for governance, risk management, and compliance related to the organization's data cannot be outsourced. Management is still responsible for ensuring that the provider meets security and privacy requirements.
Question 5: An IS auditor is evaluating the structure of an organization's IT governance. The presence of an IT strategy committee and an IT steering committee is noted. What is the key distinction between the roles of these two committees?
- The strategy committee focuses on long-term direction and alignment with business goals, while the steering committee focuses on the execution and implementation of specific projects. [1] (Correct answer)
- The steering committee is responsible for setting the IT budget, while the strategy committee is responsible for approving individual project expenditures.
- The strategy committee is composed entirely of IT staff, whereas the steering committee includes only business users.
- The steering committee reports to the Chief Information Officer (CIO), while the strategy committee reports to the board of directors.
Correct answer: The strategy committee focuses on long-term direction and alignment with business goals, while the steering committee focuses on the execution and implementation of specific projects. [1]
The IT strategy committee advises the board of directors on the alignment of IT with the business direction and focuses on future strategic issues. [1] The IT steering committee is more tactical, overseeing the implementation of the IT strategy, approving project plans, and allocating resources for specific projects. [2, 14]
Question 6: A CISA is reviewing a company's IT governance framework and notices it is heavily based on COBIT. Which of the following is a core principle of the COBIT framework?
- Focusing exclusively on technical controls for IT infrastructure.
- Providing detailed guidance for IT service management processes.
- Separating governance from management. [16] (Correct answer)
- Mandating the use of specific software for risk management.
Correct answer: Separating governance from management. [16]
A fundamental principle of the COBIT framework is the distinction between governance and management. Governance ensures that stakeholder needs are evaluated to determine balanced, agreed-on enterprise objectives, while management is responsible for planning, building, running, and monitoring activities in alignment with the direction set by the governance body to achieve the enterprise objectives. [16, 24]
CISA - Certified Information Systems Auditor IT Governance and Strategy Questions and Answers
An IS auditor is reviewing an organization's IT strategic planning process.
Which of the following is the MOST crucial for ensuring the alignment of the IT strategy with the business strategy?