CISA Protection of Information Assets Practice Question
Which of the following is the PRIMARY purpose of conducting a privacy impact assessment (PIA) before implementing a new system that processes personal data?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To identify and mitigate privacy risks.
PIA aims to identify and mitigate privacy risks early in the project lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To document data flows for audit purposes.
Why it's wrong here
Documenting data flows is an input a PIA uses, not its primary purpose; the assessment evaluates privacy risks and whether processing is necessary and proportionate. Data-flow documentation suits building records of processing and audit trails, not determining risk mitigation before implementation.
- ✓
To identify and mitigate privacy risks.
Why this is correct
A PIA systematically identifies privacy risks and evaluates mitigation before personal data processing begins, satisfying the stem's pre-implementation constraint. It examines data flows, legal bases and controls, enabling the organisation to reduce identified risks early rather than after deployment, when remediation is costlier and exposure already exists.
- ✗
To obtain consent from data subjects.
Why it's wrong here
A PIA identifies and mitigates privacy risks and assesses necessity and proportionality; consent is a separate lawful-basis mechanism collected from data subjects. Consent gathering would be the right activity when relying on consent as the processing basis, not for assessing a system's privacy impact.
- ✗
To ensure compliance with data protection regulations.
Why it's wrong here
Regulatory compliance is an outcome a PIA supports, but its primary purpose is identifying and mitigating privacy risks to individuals before processing begins. Compliance auditing suits checking adherence to obligations after design; a PIA informs design decisions by assessing risks and necessity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.