CISA Governance and Management of IT Practice Question
A multinational corporation has defined its risk appetite as 'moderate' for IT investments. The IT steering committee is evaluating a new project with potential high returns but also significant cybersecurity risks. The project's risk profile is assessed as 'high' by the risk management team. What should the committee do FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Request the project team to identify risk mitigation measures.
The correct first step. When a project's risk profile exceeds the defined risk appetite, the committee should not immediately reject or approve it. Instead, they should first explore whether risk mitigation measures can reduce the risk to an acceptable level. This aligns with governance best practices to balance risk and reward. Option B is premature without assessing mitigation. Option C escalates too early before considering mitigations. Option D rejects the opportunity without considering potential mitigation, which may discard valuable projects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Request the project team to identify risk mitigation measures.
Why this is correct
Correct. The first step is to request the project team to identify risk mitigation measures that could bring the risk down to a moderate level, aligning with the risk appetite.
- ✗
Approve the project but increase monitoring.
Why it's wrong here
Incorrect. Approving the project with increased monitoring without first exploring mitigation ignores the risk appetite and may expose the organization to unacceptable risk.
- ✗
Escalate the decision to the board of directors.
Why it's wrong here
Incorrect. Escalation to the board should occur after the steering committee has evaluated mitigation options and determined the residual risk still exceeds appetite or requires board-level decision.
- ✗
Reject the project immediately as it exceeds risk appetite.
Why it's wrong here
Incorrect. Rejecting immediately without considering mitigation may cause the organization to miss valuable opportunities that could be managed with appropriate controls.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.