CISA Governance and Management of IT Practice Question
Which THREE of the following are indicators of mature IT governance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IT risks are formally assessed and managed.
Options B, D, and E are correct. Mature IT governance is indicated by formal risk assessment and management (B), alignment of IT decisions with business strategy (D), and regular board reporting on IT performance (E). Option A (high staff retention) is an HR metric, not a governance indicator. Option C (on-time and within-budget projects) is a project management measure, not a governance maturity indicator.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IT department has high staff retention.
Why it's wrong here
Staff retention is not a governance indicator.
- ✓
IT risks are formally assessed and managed.
Why this is correct
Formal assessment and management of IT risks indicates mature IT governance by demonstrating a structured, proactive approach to safeguarding organisational assets. This systematic process moves beyond ad-hoc reactions, encompassing continuous identification, evaluation, mitigation, and monitoring of potential threats. Such formalisation signifies an organisation's commitment to repeatable, controlled mechanisms for achieving strategic objectives, a definitive characteristic of governance maturity.
- ✗
IT projects are completed on time and within budget.
Why it's wrong here
Project performance is operational, not governance.
- ✓
IT decisions are aligned with business strategy.
Why this is correct
Alignment is a key indicator of governance maturity.
- ✓
The board receives regular IT performance reports.
Why this is correct
Board reporting demonstrates governance oversight.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.