CISA Governance and Management of IT Practice Question
A multinational corporation is evaluating its IT governance structure. The board wants to ensure that IT investments are prioritized based on risk and value. Which framework component is MOST critical?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Portfolio management process
A portfolio management process systematically evaluates and prioritizes investments based on risk and value, aligning with board objectives. Steering committee provides oversight, but portfolio management is the mechanism for prioritization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service level agreements
Why it's wrong here
SLAs govern service delivery targets between provider and consumer; they do not rank investment proposals by risk and value. They are tempting because they formalise performance expectations, and would be the right component when the board's concern is measuring operational service performance against agreed targets.
- ✗
Balanced scorecard
Why it's wrong here
A balanced scorecard measures organisational performance across financial and non-financial perspectives; it reports outcomes rather than prioritising investment proposals by risk and value. It is tempting because it links strategy to metrics, and would be correct where the board needs a performance measurement system rather than an investment decision mechanism.
- ✗
IT steering committee
Why it's wrong here
An IT steering committee provides ongoing oversight and prioritisation of IT initiatives, but the board's requirement is the framework component that evaluates and ranks investments by risk and value. It is tempting because committees do make prioritisation decisions, and would be correct where governance needs a standing decision-making body rather than an evaluation method.
- ✓
Portfolio management process
Why this is correct
Portfolio management processes let the board prioritise and monitor IT investments against risk and value criteria, directly satisfying the stem's requirement. It provides the governance mechanism for balancing investment mix, whereas other components address resource, performance or compliance concerns.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.