ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITEasy
A CISA is auditing an organization's IT asset management process. The CISA discovers that while hardware assets are meticulously tracked from acquisition to disposal, software licenses are only tracked at the point of purchase, with no ongoing monitoring of usage or installation. What is the MOST significant risk introduced by this practice?
- AChallenges in accurately forecasting future software budget requirements.
- BHigher likelihood of non-compliance with software vendor licensing agreements.
- CReduced operational efficiency due to manual software inventory processes.
- DIncreased difficulty in performing software upgrades and patches.
Show answer & explanationAnswer & explanation
Correct answer: B. Higher likelihood of non-compliance with software vendor licensing agreements.
Without ongoing monitoring of software installations and usage, an organization runs a significant risk of being over-licensed (wasting money) or, more critically, under-licensed, leading to non-compliance with software vendor agreements. This can result in hefty fines, legal action, and reputational damage.
Why the other options are wrong
- A. While budgeting can be challenging, the primary risk is legal and financial exposure from non-compliance, which is often more severe.
- C. Operational inefficiency is a concern, but the legal and financial implications of non-compliance are a more significant risk.
- D. Software upgrades and patches are typically managed through separate patch management processes, not directly impacted by license usage tracking.
Software Asset Management (SAM)
The practice of managing and optimizing the purchase, deployment, maintenance, utilization, and disposal of software applications within an organization to ensure compliance and cost-effectiveness.
- Prevents over-licensing (waste) and under-licensing (non-compliance).
- Requires continuous monitoring of installations and usage.
- Reduces legal and financial risks.
Memory trick: Untracked software, unexpected fines.