CISM Information Security Programme Practice Question
A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?
⚠ Common exam trap
CISM often tests reporting-line independence — candidates choose CIO reporting as 'IT-savvy' when the correct answer is board/audit committee reporting to ensure objectivity and governance influence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Report to the board of directors or audit committee
For information security to be independent and influential, the CISO should report to the board of directors or audit committee (C). This reporting line ensures the security function is not subordinate to IT operations (which it must oversee) and gives it direct access to the highest governance body, enabling objective oversight and adequate resourcing. Independence is critical because the CISO must be able to raise risk concerns without conflicts of interest from IT management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Report to the Chief Financial Officer (CFO)
Why it's wrong here
The CFO governs finance, so security reporting there lacks the operational and risk oversight remit needed to direct enterprise controls, reducing influence. It is tempting because budget authority sits with finance, but the CISO generally reports to the CEO or board to preserve independence from financial priorities.
- ✗
Report to the Chief Information Officer (CIO)
Why it's wrong here
The CIO owns IT delivery, so security reporting there places the CISO under the function being audited, compromising independence. It is tempting because IT alignment appears natural, yet effective governance requires the CISO to report to the CEO or board, outside the delivery chain being overseen.
- ✓
Report to the board of directors or audit committee
Why this is correct
Reporting to the board or audit committee gives security direct access to governing authority, free from operational conflicts inherent in reporting through IT or finance. This structural independence enables escalation, budget influence and objective oversight of management's risk decisions.
- ✗
Report to the Chief Operating Officer (COO)
Why it's wrong here
The COO owns operations and service delivery, so security reporting there creates pressure to prioritise uptime over controls, weakening independence. It is tempting because operational influence appears strong, yet the CISO typically reports to the CEO or board to avoid conflicts inherent in delivery-focused lines.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.