CISA Practice Question: An auditor discovers that a financial…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Inconsistent security controls across units

  Why this is correct

  Decentralised application management lets each business unit define its own access rules, patching cycles and configuration baselines, so controls diverge across the institution. That inconsistency directly satisfies the stem's primary-risk framing: no central authority enforces uniform standards, leaving weaker units as exploitable entry points for attackers.

• ✗

  Reduced agility in responding to business needs

  Why it's wrong here

  Decentralised units respond quickly to their own business needs because they control their applications directly. Reduced agility is a characteristic of centralised IT governance, where change requests queue through one team, not of business-unit autonomy.

• ✗

  Difficulty in scaling IT infrastructure

  Why it's wrong here

  Scaling infrastructure is achievable in a decentralised model because each unit provisions its own capacity independently. This risk applies to centralised models where a single team becomes a bottleneck, not to distributed units controlling their own application resources.

• ✗

  Higher IT costs due to duplication

  Why it's wrong here

  Duplication across business units is a genuine decentralised-model concern, but the primary risk is inconsistent controls and fragmented security oversight across applications. Cost duplication is secondary to governance and compliance exposure in a financial institution.

Go deeper

Related to this question