CISA Governance and Management of IT Practice Question
A medium-sized manufacturing company has a decentralized IT structure where each business unit manages its own IT budget and projects. The CEO is concerned that IT investments are not aligned with corporate strategy and that there is duplication of effort. The IT department lacks a formal project portfolio management process. The company has experienced several project failures due to poor prioritization. The CEO has asked the newly hired IT auditor to recommend an initial step to improve IT governance. The auditor should recommend:
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establishing an IT steering committee with representatives from business units and IT
An IT steering committee provides governance oversight, ensures alignment with corporate strategy, and helps prioritize projects to avoid duplication. This foundational step addresses the root cause of poor alignment and project failures before implementing tools or processes. Option B is premature because a tool without governance oversight may not improve prioritization. Option C focuses on security, not overall strategic alignment. Option D is drastic and does not address internal governance issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Establishing an IT steering committee with representatives from business units and IT
Why this is correct
A steering committee provides strategic direction, prioritization, and governance over IT investments.
- ✗
Implementing a project portfolio management software tool immediately to track all projects
Why it's wrong here
Implementing a tool without governance structure will not address the root cause of misalignment.
- ✗
Conducting a security risk assessment of all IT systems
Why it's wrong here
This addresses security, not the broader governance and alignment issues.
- ✗
Outsourcing IT management to a third-party provider
Why it's wrong here
Outsourcing does not solve internal governance and may introduce new risks.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are key responsibilities of an IT steering committee?
medium- ✓ A.Monitoring IT performance and value delivery
- B.Managing day-to-day IT operations
- C.Writing and testing application code
- ✓ D.Prioritizing IT projects and allocating resources
- E.Conducting IT audit engagements
Why A: The IT steering committee is a senior-level governance body responsible for aligning IT strategy with business objectives. Monitoring IT performance and value delivery (A) is a key responsibility because the committee must ensure that IT investments generate the expected business benefits and that service levels meet agreed targets. Prioritizing IT projects and allocating resources (D) is also a core duty, as the committee decides which initiatives receive funding and staffing based on strategic importance and risk, rather than operational urgency.
Variation 2. A medium-sized manufacturing company has recently deployed an ERP system to integrate its financial, supply chain, and HR processes. The IT department is small (5 staff) and reports to the CFO. The company has no formal IT governance committee; IT decisions are made by the CFO and CEO informally. During a recent audit, it was found that several critical security patches for the ERP system have not been applied, and there are no documented procedures for change management. The IT manager states that patches are applied when time permits, and changes are discussed via email. The CFO argues that the ERP is running fine and the audit findings are low risk. The IS auditor needs to recommend a course of action to improve IT governance. Which of the following is the MOST appropriate initial step?
easy- A.Elevate the issue to the board of directors with a recommendation to outsource IT management
- ✓ B.Recommend the formation of an IT steering committee comprising key business stakeholders to oversee IT strategy, risk, and resource allocation
- C.Develop a comprehensive patch management policy and present it to the CFO for approval
- D.Insist that the IT manager immediately apply all missing patches within one week
Why B: The root cause is the absence of any formal governance structure. Establishing an IT steering committee with key business stakeholders (e.g., from finance, supply chain, HR) provides oversight, ensures that IT decisions align with business strategy, and creates a forum for prioritizing risks such as missing patches. This addresses the governance gap holistically. Option A is not appropriate because outsourcing does not fix the lack of internal governance and is an extreme measure. Option C focuses only on patching, not on the underlying governance deficiency. Option D is an operational quick fix that bypasses the need for sustainable governance processes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.