hardMultiple ChoiceObjective-mapped
CISA Practice Question: An auditor is reviewing IT policy compliance and…
An auditor is reviewing IT policy compliance and finds that a critical policy was last updated three years ago. The organization has undergone significant changes. What is the auditor's PRIMARY concern?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy may not be aligned with current business objectives
Policies should be reviewed and updated regularly to remain current and effective. The primary concern is that the policy may no longer be relevant or effective due to changes in the organization, technology, or regulatory environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Employees may not be aware of the policy
Why it's wrong here
Awareness can be addressed separately; the primary concern is the policy's relevance and effectiveness.
- ✗
The policy may not have been approved by management
Why it's wrong here
Approval is important but the age indicates lack of review, not necessarily lack of approval.
- ✗
The policy may not be enforced
Why it's wrong here
Enforcement is a separate issue; the policy's content may be obsolete.
- ✓
The policy may not be aligned with current business objectives
Why this is correct
Outdated policies may not reflect current objectives, risks, or regulatory requirements, leading to governance gaps.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.