CISA IT Steering Committee Practice Question
A medium-sized manufacturing company has recently deployed an ERP system to integrate its financial, supply chain, and HR processes. The IT department is small (5 staff) and reports to the CFO. The company has no formal IT governance committee; IT decisions are made by the CFO and CEO informally. During a recent audit, it was found that several critical security patches for the ERP system have not been applied, and there are no documented procedures for change management. The IT manager states that patches are applied when time permits, and changes are discussed via email. The CFO argues that the ERP is running fine and the audit findings are low risk. The IS auditor needs to recommend a course of action to improve IT governance. Which of the following is the MOST appropriate initial step?
⚠ Common exam trap
The trap is to pick a procedural fix (patch policy or immediate patching) or an extreme measure (outsourcing) instead of recognizing the fundamental governance deficiency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recommend the formation of an IT steering committee comprising key business stakeholders to oversee IT strategy, risk, and resource allocation
The root cause is the absence of any formal governance structure. Establishing an IT steering committee with key business stakeholders (e.g., from finance, supply chain, HR) provides oversight, ensures that IT decisions align with business strategy, and creates a forum for prioritizing risks such as missing patches. This addresses the governance gap holistically. Option A is not appropriate because outsourcing does not fix the lack of internal governance and is an extreme measure. Option C focuses only on patching, not on the underlying governance deficiency. Option D is an operational quick fix that bypasses the need for sustainable governance processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Elevate the issue to the board of directors with a recommendation to outsource IT management
Why it's wrong here
Incorrect. Outsourcing is a potential solution but not the most appropriate initial step; it bypasses internal governance.
- ✓
Recommend the formation of an IT steering committee comprising key business stakeholders to oversee IT strategy, risk, and resource allocation
Why this is correct
Correct. This addresses the root cause of lack of governance and oversight.
- ✗
Develop a comprehensive patch management policy and present it to the CFO for approval
Why it's wrong here
Incorrect. A policy without governance structure may not be enforced; also, it is too narrow.
- ✗
Insist that the IT manager immediately apply all missing patches within one week
Why it's wrong here
Incorrect. While necessary, this is a tactical fix that does not address the governance deficiency.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.