CISA Governance and Management of IT Practice Question
An IS auditor is reviewing an organization's IT governance structure and finds that the IT steering committee meets quarterly but has no defined charter or decision-making authority. Which of the following is the MOST significant risk arising from this situation?
⚠ Common exam trap
The trap here is focusing on operational symptoms like delays or budget overruns rather than the foundational governance deficiency of an undefined mandate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IT initiatives may not be aligned with business strategy due to unclear governance mandate.
A steering committee without a formal charter and decision-making authority cannot fulfill its governance role. The most critical risk is that IT initiatives will not be aligned with business strategy because the committee lacks the mandate to prioritize and enforce alignment. This undermines the entire purpose of IT governance, making other operational risks secondary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The committee may lack the technical expertise to evaluate IT projects.
Why it's wrong here
While expertise is important, the absence of a charter and authority is a more fundamental governance deficiency. Expertise can be supplemented with subject matter experts, but without a mandate, even expert advice may not be acted upon. The primary risk is not technical capability but the committee's inability to make binding decisions and enforce alignment.
- ✗
IT projects may experience delays due to infrequent meetings.
Why it's wrong here
Quarterly meetings might cause delays, but this is an operational inefficiency rather than a governance failure. The lack of a charter and authority means decisions made in those meetings may not be recognized or enforced, leading to broader issues like unmanaged risks and misalignment. Delay is a symptom, not the root risk.
- ✓
IT initiatives may not be aligned with business strategy due to unclear governance mandate.
Why this is correct
Without a charter and authority, the committee cannot enforce alignment between IT investments and business goals. This is the most significant risk because governance structures exist to provide direction and oversight; their absence undermines strategic alignment, resource prioritization, and accountability. Other risks, while possible, are secondary to the fundamental failure of governance.
- ✗
The committee may exceed its budget due to lack of financial oversight.
Why it's wrong here
Budget overruns are possible but not the most significant risk. The committee's lack of defined authority and charter means it cannot effectively oversee IT spending or prioritize investments, which could lead to budget issues, but the overarching risk is the failure of governance to provide strategic direction and accountability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.