CISA Governance and Management of IT Practice Question
An IS auditor is reviewing the IT governance framework of a financial services firm. The auditor notes that the IT strategy is updated annually, but there is no process to monitor whether IT initiatives are aligned with the strategy. Which of the following is the BEST recommendation?
⚠ Common exam trap
The trap here is assuming that more frequent strategy updates or delegation alone will ensure alignment, when the real need is a systematic monitoring process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a balanced scorecard to track IT performance against strategic objectives.
The best recommendation is to implement a balanced scorecard to track IT performance against strategic objectives. This provides a structured, ongoing method to monitor whether IT initiatives are aligned with the IT strategy. It enables management to measure progress, identify deviations, and take corrective action. The other options either address symptoms, provide only periodic assurance, or lack a specific monitoring mechanism, making them less effective in closing the governance gap.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delegate IT strategy oversight to the IT steering committee.
Why it's wrong here
Delegating oversight to the IT steering committee is appropriate, but the scenario does not indicate that such a committee exists or that it lacks authority. The core issue is the absence of a monitoring process, not the delegation itself. Without a defined monitoring tool or process, delegation alone will not ensure alignment. This option does not provide a concrete mechanism for monitoring.
- ✗
Increase the frequency of IT strategy updates to quarterly.
Why it's wrong here
Updating the strategy more frequently does not ensure that initiatives are aligned with it. Without a monitoring process, even a quarterly updated strategy may not be executed as intended. This option addresses the symptom (static strategy) rather than the root cause (lack of alignment monitoring). It also may introduce unnecessary churn without improving governance.
- ✗
Conduct an annual external audit of IT projects.
Why it's wrong here
An annual external audit provides point-in-time assurance but does not establish continuous monitoring of alignment. It is a detective control that may identify misalignment after the fact, rather than a preventive or monitoring mechanism. The scenario calls for a process to monitor alignment, which implies ongoing oversight, not periodic audits.
- ✓
Implement a balanced scorecard to track IT performance against strategic objectives.
Why this is correct
A balanced scorecard translates strategic objectives into measurable metrics across financial, customer, internal process, and learning perspectives. It provides a mechanism to monitor alignment of IT initiatives with the strategy on an ongoing basis. This directly addresses the gap of no monitoring process. Other options may be useful but do not provide the comprehensive, strategic alignment focus that a balanced scorecard offers.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.