CISA Governance and Management of IT Practice Question
A multinational manufacturing company with operations in 20 countries has historically allowed each regional division to manage its own IT systems independently. Recently, the company experienced a significant data breach originating from a region with weaker security controls, leading to financial losses and reputational damage. The board has mandated stronger IT governance to prevent future incidents. The CIO proposes implementing a global IT governance framework with centralized policy enforcement. However, regional directors argue that local regulations and business needs require autonomy. The governance committee must decide on a course of action that balances risk and business flexibility. Which of the following approaches is the MOST appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adopt a federated governance model with global policies and local flexibility within defined tolerances.
The most appropriate approach is the federated governance model (Option A), which establishes global policies and standards centrally while allowing regional divisions to adapt within defined risk tolerances. This balances the board's mandate for stronger IT governance with legitimate local regulatory and business needs. Option B (quarterly reporting) is insufficient because it does not enforce any binding controls, leaving the company vulnerable to future breaches. Option C (fully centralized) may ignore critical local regulations and hinder business agility, leading to non-compliance and operational friction. Option D (status quo with minimum standards) is too weak; after a significant breach, a more robust framework requiring proactive governance is needed, not just baseline security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Adopt a federated governance model with global policies and local flexibility within defined tolerances.
Why this is correct
Federated governance balances consistency with local adaptation.
- ✗
Allow each region to continue independently but require quarterly reporting to the committee.
Why it's wrong here
This does not address the root cause of inconsistent controls.
- ✗
Implement a fully centralized IT governance model with no regional deviations.
Why it's wrong here
Ignoring local regulations and business needs could cause compliance issues and resistance.
- ✗
Maintain the status quo but enforce minimum security standards across all regions.
Why it's wrong here
Minimum standards may not be sufficient to prevent a repeat incident and lack governance oversight.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.