CISA Governance and Management of IT Practice Question
A large enterprise is assessing its IT governance maturity. Which THREE of the following are indicators of a mature governance process? (Select exactly three.)
⚠ Common exam trap
CISA often tests whether candidates can distinguish mature governance indicators (formal committees, business-linked metrics, board review) from immature practices (silos, historical budgeting) that are sometimes mistaken for stability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is a formal IT governance committee
Option C is correct because a formal IT governance committee establishes clear accountability, decision rights, and oversight structures, which are hallmarks of a mature governance process rather than ad hoc or siloed decision-making. Option D is correct because linking IT performance metrics to business outcomes demonstrates that governance is aligned with enterprise strategy and value delivery, a key maturity indicator in frameworks such as COBIT. Option E is correct because regular board-level review of IT strategy, such as quarterly, shows sustained executive engagement, strategic alignment, and proactive oversight rather than reactive or infrequent attention. Options A and B do not belong because siloed IT decision-making and budget allocation based solely on historical spending reflect immature, reactive governance practices that lack integration, strategic alignment, and value-based prioritization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IT decisions are made in silos
Why it's wrong here
Siloed decision-making fragments accountability, so IT investment cannot be aligned to enterprise strategy or risk appetite, which mature governance demands. It is tempting because departmental autonomy speeds local decisions, and would be correct in a decentralised structure where each unit owns its own budget and roadmap.
- ✗
IT budget is allocated based on historical spending
Why it's wrong here
Historical budgeting perpetuates prior spend rather than linking investment to strategic objectives and measured value delivery, which mature governance requires. It is tempting because incremental budgeting is stable and auditable, and would suit steady-state operational funding where demand and scope rarely change.
- ✓
There is a formal IT governance committee
Why this is correct
A formal IT governance committee provides the standing oversight structure through which decisions, accountability and resource direction are exercised. Its existence demonstrates that governance is institutionalised rather than ad hoc, which is a recognised indicator of a mature governance process.
- ✓
IT performance metrics are linked to business outcomes
Why this is correct
Linking IT performance metrics to business outcomes shows that IT is measured by the value it delivers rather than by technical activity alone. This alignment demonstrates mature governance, where IT decisions and reporting are driven by enterprise objectives.
- ✓
IT strategy is reviewed quarterly by the board
Why this is correct
Quarterly board review of IT strategy demonstrates active, ongoing top-level engagement rather than annual or reactive attention. Regular board scrutiny ensures IT direction stays aligned with enterprise objectives and is a recognised indicator of mature governance.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.