ISACA Governance and Management of IT 4

Question 1

An organization has a high IT risk appetite but weak internal controls. An IS auditor should PRIMARILY recommend:

Accepted Answer

Aligning the control environment with the documented risk appetite

Answer

Risk appetite must be supported by a matching control environment; the audit finding is the misalignment between stated appetite and actual controls.

Question 2

Which of the following BEST describes the difference between IT governance and IT management?

Accepted Answer

Governance sets direction and evaluates; management plans and executes

Answer

Governance involves evaluating, directing, and monitoring, while management focuses on planning, building, running, and monitoring operations.

Question 3

A large enterprise uses a federated IT governance model. This means IT governance decisions are:

Accepted Answer

Distributed across business units with some central coordination

Answer

A federated model distributes IT governance authority to business units while maintaining central coordination for enterprise-wide standards.

Question 4

When assessing IT governance maturity using COBIT's capability model, a score of Level 2 indicates:

Accepted Answer

The process is performed and managed with planned objectives

Answer

COBIT's Level 2 (Managed Process) means the process is performed and managed — planned, monitored, and adjusted — with defined outcomes.

Question 5

Which concept in IT governance ensures that the board of directors remains informed about significant IT risks and opportunities?

Accepted Answer

Escalation procedures

Answer

Escalation procedures ensure significant IT risks, incidents, and opportunities are reported up to senior management and the board.

(ISACA) Information Systems Audit and Control Association Certification Practice Test