CISA Information System Auditing Process Practice Question
Which THREE of the following are characteristics of a SMART recommendation? (Select three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Measurable
A SMART recommendation must be Measurable (A), meaning it includes quantifiable criteria or metrics (e.g., a percentage, count, or threshold) so progress and success can be objectively verified. It must also be Time-bound (C), specifying a deadline or timeframe (e.g., "within 90 days") so the recommendation has a defined completion point. Finally, it must be Specific (D), clearly stating the exact action, system, or process to be changed rather than a vague aspiration. The unmarked options do not belong: General (B) contradicts the specificity requirement of SMART, and Subjective (E) is wrong because SMART criteria rely on objective, verifiable evidence rather than personal opinion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Measurable
Why this is correct
Measurable makes the recommendation verifiable: it specifies a quantifiable metric or threshold so the auditee and auditor can objectively confirm whether the action was implemented and effective, satisfying the SMART criterion that otherwise leaves recommendations unverifiable.
- ✗
General
Why it's wrong here
SMART requires Specific, so a general recommendation cannot be actioned or measured against a defined target. It is tempting because broad statements feel safe and cover many concerns, but generality is precisely what SMART criteria exclude; a specific recommendation naming the system, control gap and owner would satisfy the framework.
- ✓
Time-bound
Why this is correct
Time-bound fixes a deadline or target date for implementing the recommendation, enabling follow-up and closure tracking. Without it, management could defer remediation indefinitely, so this characteristic satisfies the SMART requirement for a defined completion horizon.
- ✓
Specific
Why this is correct
Specific ensures the recommendation states precisely what action is required, who owns it and where it applies, rather than a vague aspiration. This precision lets management implement the fix directly and allows the auditor to test implementation against a clear expectation.
- ✗
Subjective
Why it's wrong here
SMART demands Measurable and objective criteria, so a subjective recommendation cannot be verified or tracked. It appeals because stakeholder opinion often drives audit findings, yet subjectivity defeats the purpose; an objectively measurable recommendation with defined metrics would meet the SMART requirement instead.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.