CISA IT Governance and Strategy 4

Question 1

When reviewing IT governance, an auditor discovers that business units independently purchase software without IT involvement. This PRIMARILY indicates a weakness in:

Accepted Answer

IT demand management and governance oversight

Answer

Shadow IT (business units procuring technology without IT oversight) signals a breakdown in IT demand management and governance authority.

Question 2

A CISA auditing IT strategy would MOST likely review which document to assess strategic alignment?

Accepted Answer

IT strategic plan compared against the enterprise strategic plan

Answer

Comparing the IT strategic plan to the enterprise strategic plan directly reveals whether IT goals are aligned with organizational objectives.

Question 3

Which of the following is an example of an IT governance output?

Accepted Answer

An approved IT policy defining acceptable use

Answer

IT governance outputs include policies, principles, frameworks, and accountability structures—not day-to-day operational activities like patching or backups.

Question 4

In IT governance, the concept of 'accountability' differs from 'responsibility' in that accountability:

Accepted Answer

Rests with one individual who answers for the final outcome

Answer

Accountability is singular and non-delegable—one person ultimately answers for an outcome—while responsibility can be shared or delegated.

Question 5

Which of the following BEST characterizes an IT governance framework versus an IT management framework?

Accepted Answer

Governance sets direction and evaluates performance; management plans and operates

Answer

Governance defines the direction, evaluates outcomes, and ensures accountability, while management handles planning, building, running, and monitoring IT activities.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA IT Governance and Strategy 4