CISA Governance and Management of IT Practice Question
An organization has decentralized IT management with each business unit making its own technology decisions. Which of the following is the BEST way to maintain enterprise-wide governance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish an enterprise architecture review board with representatives from all business units.
An enterprise architecture review board with representatives from all business units ensures alignment with enterprise-wide standards and governance while respecting decentralized decision-making. Option A is too prescriptive and may not fit all units. Option B centralizes approval, which undermines decentralization. Option C addresses budgeting, not governance of IT decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a single enterprise resource planning (ERP) system across all units.
Why it's wrong here
A single system may not meet diverse unit needs.
- ✗
Require all IT projects to be approved by the corporate IT department.
Why it's wrong here
This centralizes control, defeating decentralization benefits.
- ✗
Create a central IT budget that allocates funds to business units.
Why it's wrong here
Budget allocation does not provide governance over technology decisions.
- ✓
Establish an enterprise architecture review board with representatives from all business units.
Why this is correct
This provides governance without removing unit autonomy.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is considering restructuring its IT department from a centralized to a decentralized model to give business units more autonomy. What is a PRIMARY governance risk associated with this move?
medium- A.Difficulty in managing vendor contracts due to decentralization.
- B.Reduced innovation due to lack of central coordination.
- C.Increased risk of project cost overruns.
- ✓ D.Inconsistent IT policies and security controls across business units.
Why D: The primary governance risk when moving from a centralized to a decentralized IT model is the potential for inconsistent IT policies and security controls across business units (Option D). Decentralization gives business units autonomy, which can lead to differences in how IT policies are interpreted and applied, increasing the risk of security gaps and non-compliance. Option A (difficulty in managing vendor contracts) is a valid operational concern but not a primary governance risk. Option B (reduced innovation) is unlikely, as decentralization often fosters innovation. Option C (increased cost overruns) can occur but is typically a financial risk rather than a governance risk.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.