CISA Governance and Management of IT Practice Question
A company is considering restructuring its IT department from a centralized to a decentralized model to give business units more autonomy. What is a PRIMARY governance risk associated with this move?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inconsistent IT policies and security controls across business units.
The primary governance risk when moving from a centralized to a decentralized IT model is the potential for inconsistent IT policies and security controls across business units (Option D). Decentralization gives business units autonomy, which can lead to differences in how IT policies are interpreted and applied, increasing the risk of security gaps and non-compliance. Option A (difficulty in managing vendor contracts) is a valid operational concern but not a primary governance risk. Option B (reduced innovation) is unlikely, as decentralization often fosters innovation. Option C (increased cost overruns) can occur but is typically a financial risk rather than a governance risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Difficulty in managing vendor contracts due to decentralization.
Why it's wrong here
Difficulty in managing vendor contracts is an operational risk, not a primary governance risk.
- ✗
Reduced innovation due to lack of central coordination.
Why it's wrong here
Decentralization often increases innovation, so this is not a primary governance risk.
- ✗
Increased risk of project cost overruns.
Why it's wrong here
Cost overruns are a financial risk, not a direct governance risk.
- ✓
Inconsistent IT policies and security controls across business units.
Why this is correct
Inconsistent IT policies and security controls directly impact governance by undermining standardization and control.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.