CISA Governance and Management of IT Practice Question
A global retail company is implementing an IT governance framework. The board of directors has asked the IS auditor to identify the KEY components that should be included in the framework to ensure effective governance. Which TWO of the following are essential components of an IT governance framework? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse operational activities like technical training or specific development methodologies with the strategic components of IT governance, which focus on direction, alignment, and oversight.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Performance measurement and monitoring
IT strategic alignment and performance measurement are core components of an IT governance framework. Alignment ensures IT supports business goals, while performance measurement provides the feedback loop to assess effectiveness and drive accountability. Other options, such as training, development methodologies, and outsourcing, are operational or strategic choices that may be governed but are not fundamental building blocks of the framework itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Outsourcing of all IT functions to a third party
Why it's wrong here
Outsourcing is a strategic decision that may be considered within IT governance, but it is not an essential component of a governance framework. Governance must be in place regardless of whether IT is insourced or outsourced; in fact, outsourcing increases the need for strong governance to manage vendor risks. Treating outsourcing as a required component would incorrectly suggest that governance is only necessary when IT is external, which is not true.
- ✗
Detailed technical training for all IT staff
Why it's wrong here
While technical training is important for operational competence, it is not a core component of an IT governance framework. Governance focuses on direction, oversight, and accountability at the strategic level, not on the specific skills of IT personnel. Training is an operational activity that supports execution but does not define the governance structure itself. Including it as a key component would dilute the strategic focus of governance.
- ✓
Performance measurement and monitoring
Why this is correct
Performance measurement and monitoring are essential to IT governance because they provide the means to assess whether IT is delivering value, managing risks, and using resources efficiently. Without metrics and monitoring, the board and management cannot make informed decisions or hold IT accountable. This component enables continuous improvement and ensures that governance objectives are being met. It is a recognized pillar of effective governance frameworks.
- ✗
Use of a specific software development methodology
Why it's wrong here
A software development methodology, such as Agile or Waterfall, is a tactical choice for managing projects and is not a component of IT governance. Governance is concerned with overarching direction, oversight, and control, not with the specific methods used to develop software. While methodologies can be standardized under governance, they are not fundamental components. Including one as essential would be too prescriptive and overlook the broader governance scope.
- ✓
IT strategic alignment with business objectives
Why this is correct
IT strategic alignment ensures that IT investments and activities directly support the organization's business goals. It is a fundamental component of IT governance because it drives value delivery and ensures that IT is not pursued for its own sake. Without alignment, IT may become a cost center rather than a strategic enabler, leading to wasted resources and missed opportunities. This alignment is consistently recognized in governance frameworks as a core principle.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.