CISA Practice Question: An IT auditor is reviewing the organization's…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Policy, Guideline, Standard, Procedure, Work instruction

  Why it's wrong here

  Guidelines are discretionary recommendations that sit below standards, so placing Guideline second misorders the chain. It is tempting because guidelines are advisory and often confused with standards, but this order would be correct only if guidelines were mandatory and standards optional.

• ✓

  Policy, Standard, Guideline, Procedure, Work instruction

  Why this is correct

  Policy sits at the top, stating management intent, followed by standards that mandate specific controls, then guidelines, procedures and work instructions. Each lower layer becomes progressively more detailed and operational, satisfying the hierarchy the auditor must verify.

• ✗

  Procedure, Policy, Standard, Guideline, Work instruction

  Why it's wrong here

  Procedures are operational, step-level documents that sit near the bottom of the hierarchy, so leading with Procedure inverts the authority chain. It is tempting because procedures are mandatory, but they would rank highest only in a scenario where no policy or standard existed above them.

• ✗

  Standard, Policy, Guideline, Procedure, Work instruction

  Why it's wrong here

  This reverses the hierarchy: standards sit below policies, and guidelines sit below standards, so placing Standard first inverts the authority chain. It is tempting because all five artefacts exist, but the ordering is correct only when policy is named as the highest-level document.