CISA Governance and Management of IT Practice Question
An IT department is struggling with project delays and budget overruns. Which governance practice would be MOST effective?
⚠ Common exam trap
CISA often tests the distinction between governance practices and operational improvements; candidates may mistakenly choose agile or outsourcing as quick fixes, but governance requires establishing oversight structures like a PMO.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establishing a project management office (PMO)
A PMO provides centralized governance, standardizes project management processes, and enforces oversight across all projects. This directly addresses the root causes of delays and overruns—lack of consistent methodology, resource coordination, and performance monitoring. By establishing a PMO, the IT department gains the structure needed to plan, execute, and control projects effectively, making it the most comprehensive governance practice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Establishing a project management office (PMO)
Why this is correct
A PMO imposes standardised project methodologies, stage gates and resource oversight across the portfolio, directly addressing the root causes of schedule slippage and cost overruns. It centralises reporting and accountability, giving governance bodies the visibility needed to correct deviations early.
- ✗
Outsourcing projects
Why it's wrong here
Outsourcing transfers delivery to a vendor but leaves the underlying governance deficiencies intact, so delays and overruns persist under contract. It tempts because external expertise can rescue a failing project, and outsourcing is correct when the organisation genuinely lacks a required capability rather than lacking project oversight.
- ✗
Increasing IT staff
Why it's wrong here
Adding staff addresses capacity, not the governance gaps causing delays and overruns; without portfolio oversight and stage-gate controls, more people simply scale the same unmanaged work. It tempts because resourcing feels like a direct fix, and headcount increases are the right answer when a validated capacity shortfall, not governance failure, is the constraint.
- ✗
Adopting agile methodology
Why it's wrong here
Agile changes delivery cadence, not the portfolio-level decision-making and budget control whose absence produced the overruns; iterative delivery cannot substitute for governance. It tempts because agile visibly improves project transparency, and it is the right choice when requirements are volatile and rapid feedback, not oversight, is the missing element.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.