The correct next step is to conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool. This is because ITIL best practices mandate that process design must precede tool selection; jumping to a self-service portal without first mapping incident management workflows—such as categorization, prioritization, and escalation—risks forcing the tool to drive the process rather than the other way around. On the CISA exam, this scenario tests your understanding of IT governance and the principle that a business case must validate requirements against a recognized framework before investment approval. A common trap is choosing a tool based on features or user preference, ignoring that the steering committee’s core concern is alignment with ITIL. Remember the mnemonic “Process Before Product” to recall that defining the process first ensures the tool serves the workflow, not the reverse.
CISA Governance and Management of IT Practice Question
This CISA practice question tests your understanding of governance and management of it. Compare every option against the stated constraints before choosing — the best answer satisfies all requirements, not just the most obvious one. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A mid-sized company is implementing a new IT service management (ITSM) tool to improve incident management. The IT manager wants to ensure that the tool aligns with ITIL best practices. The company has a dedicated service desk team that handles about 200 incidents per week. The IT manager is considering whether to implement a self-service portal for users to submit incidents and check status, or to continue using email-based incident reporting. The service desk team is concerned that a self-service portal might reduce their direct interaction with users and potentially lead to less personalized support. However, the IT manager believes that a portal could improve efficiency and tracking. The company's IT governance framework requires that any major IT investment be approved by the steering committee and that there be a clear business case. The IT manager has prepared a business case but the steering committee wants to ensure that the solution is aligned with ITIL and that it addresses key incident management processes. Which of the following is the most appropriate next step for the IT manager?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool.
Option B is correct because ITIL best practices emphasize that process design should precede tool selection. Conducting a process review with stakeholders ensures the self-service portal aligns with defined incident management workflows, such as categorization, prioritization, and escalation, before committing to a specific tool. This step also satisfies the IT governance requirement for a clear business case by validating requirements against ITIL guidelines.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Implement the self-service portal immediately to improve efficiency, then present the business case later.
Why it's wrong here
Implementing before approval contradicts governance framework.
✓
Conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool.
Why this is correct
This ensures alignment with ITIL and addresses concerns through stakeholder involvement.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Proceed with the self-service portal without further review because it is clearly beneficial.
Why it's wrong here
Skipping the steering committee approval violates governance requirements.
✗
Abandon the self-service portal idea and continue with email-based reporting.
Why it's wrong here
This dismisses potential benefits without proper evaluation.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may assume any self-service portal automatically improves efficiency and aligns with ITIL, but CISA tests the principle that process definition must precede tool selection to ensure governance and best practice alignment.
Detailed technical explanation
How to think about this question
ITIL's incident management process includes specific stages such as incident logging, categorization, prioritization, initial diagnosis, escalation, and closure. A self-service portal must integrate with these stages, for example by enforcing mandatory fields for categorization codes (e.g., based on the ITIL Common Service Desk model) and automatically assigning priority based on impact and urgency. In a real-world scenario, a portal that lacks integration with the ITIL-defined escalation matrix could cause critical incidents to be misrouted, leading to SLA breaches and audit findings.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CISA exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Governance and Management of IT — This question tests Governance and Management of IT — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Conduct a process review with stakeholders to define requirements based on ITIL guidelines before selecting a tool. — Option B is correct because ITIL best practices emphasize that process design should precede tool selection. Conducting a process review with stakeholders ensures the self-service portal aligns with defined incident management workflows, such as categorization, prioritization, and escalation, before committing to a specific tool. This step also satisfies the IT governance requirement for a clear business case by validating requirements against ITIL guidelines.
What should I do if I get this CISA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.