CISA - Certified Information Systems Auditor IT Governance and Strategy Questions and Answers

Question 1

An IS auditor is reviewing an organization's IT strategic planning process. Which of the following is the MOST crucial for ensuring the alignment of the IT strategy with the business strategy?

Accepted Answer

The IT steering committee is composed of representatives from key business functions and IT.

Answer

The IT strategic plan is reviewed and approved by the IT department's senior management.

Answer

The IT strategic plan is primarily driven by the latest technological innovations.

Answer

The IT budget is allocated based on the previous year's expenditures.

Question 2

During a review of IT governance, an IS auditor finds that there is no formal IT risk management program. Which of the following represents the GREATEST risk to the organization?

Accepted Answer

The organization's risk appetite may be exceeded without senior management's awareness.

Answer

Increased cost of technology procurement.

Answer

IT projects may not be completed on time.

Answer

The IT department may not be able to attract skilled personnel.

Question 3

Which of the following is the PRIMARY purpose of implementing an IT balanced scorecard?

Accepted Answer

To translate IT strategy into measurable objectives and monitor its performance. [5]

Answer

To exclusively measure the financial return on IT investments.

Answer

To benchmark IT performance against competitor organizations.

Answer

To justify the IT department's annual budget requests.

Question 4

An organization has recently decided to outsource its data center operations to a third-party provider. From an IT governance perspective, what is the MOST important responsibility that remains with the organization's management?

Accepted Answer

Overall accountability for the security and privacy of the organization's data.

Answer

Performing daily backups of the outsourced systems.

Answer

Defining the detailed technical specifications for the provider's hardware.

Answer

Training the third-party provider's staff on internal procedures.

Question 5

An IS auditor is evaluating the structure of an organization's IT governance. The presence of an IT strategy committee and an IT steering committee is noted. What is the key distinction between the roles of these two committees?

Accepted Answer

The strategy committee focuses on long-term direction and alignment with business goals, while the steering committee focuses on the execution and implementation of specific projects. [1]

Answer

The steering committee is responsible for setting the IT budget, while the strategy committee is responsible for approving individual project expenditures.

Answer

The strategy committee is composed entirely of IT staff, whereas the steering committee includes only business users.

Answer

The steering committee reports to the Chief Information Officer (CIO), while the strategy committee reports to the board of directors.

Question 6

A CISA is reviewing a company's IT governance framework and notices it is heavily based on COBIT. Which of the following is a core principle of the COBIT framework?

Accepted Answer

Separating governance from management. [16]

Answer

Focusing exclusively on technical controls for IT infrastructure.

Answer

Providing detailed guidance for IT service management processes.

Answer

Mandating the use of specific software for risk management.