CISA - Certified Information Systems Auditor IT Governance and Strategy Questions and Answers

Question 1

An IS auditor is reviewing an organization's IT strategic planning process. Which of the following is the MOST crucial for ensuring the alignment of the IT strategy with the business strategy?

Accepted Answer

The IT steering committee is composed of representatives from key business functions and IT.

Answer

The primary role of an IT steering committee is to ensure that IT activities are aligned with business objectives. By having representation from key business functions, the committee can ensure that IT plans, projects, and investments support the overall goals of the enterprise. [2, 3]

Question 2

During a review of IT governance, an IS auditor finds that there is no formal IT risk management program. Which of the following represents the GREATEST risk to the organization?

Accepted Answer

The organization's risk appetite may be exceeded without senior management's awareness.

Answer

A formal IT risk management program is essential for identifying, assessing, and mitigating risks. Without it, the organization may unknowingly accept a level of risk that is higher than what senior management has deemed acceptable (the risk appetite), potentially leading to significant business impact. [30, 34]

Question 3

Which of the following is the PRIMARY purpose of implementing an IT balanced scorecard?

Accepted Answer

To translate IT strategy into measurable objectives and monitor its performance. [5]

Answer

The IT balanced scorecard is a strategic management tool used to translate the IT strategy into a comprehensive set of performance measures. It provides a balanced view by measuring performance from different perspectives, such as customer satisfaction, internal processes, and innovation, not just financial outcomes. [4, 23]

Question 4

An organization has recently decided to outsource its data center operations to a third-party provider. From an IT governance perspective, what is the MOST important responsibility that remains with the organization's management?

Accepted Answer

Overall accountability for the security and privacy of the organization's data.

Answer

While operational tasks can be delegated to a third party, the ultimate accountability for governance, risk management, and compliance related to the organization's data cannot be outsourced. Management is still responsible for ensuring that the provider meets security and privacy requirements.

Question 5

An IS auditor is evaluating the structure of an organization's IT governance. The presence of an IT strategy committee and an IT steering committee is noted. What is the key distinction between the roles of these two committees?

Accepted Answer

The strategy committee focuses on long-term direction and alignment with business goals, while the steering committee focuses on the execution and implementation of specific projects. [1]

Answer

The IT strategy committee advises the board of directors on the alignment of IT with the business direction and focuses on future strategic issues. [1] The IT steering committee is more tactical, overseeing the implementation of the IT strategy, approving project plans, and allocating resources for specific projects. [2, 14]

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor IT Governance and Strategy Questions and Answers