ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
During an audit of an organization's IT governance structure, the CISA observes that the IT steering committee meets regularly but its recommendations are frequently disregarded by business unit leaders. Which of the following is the MOST significant concern for the CISA?
- ABusiness unit leaders are not adequately trained in IT project management.
- BThe IT steering committee lacks technical expertise to make relevant recommendations.
- CThe organization's budget allocation for IT projects is insufficient.
- DThe IT governance structure is not effectively integrated with business objectives.
Show answer & explanationAnswer & explanation
Correct answer: D. The IT governance structure is not effectively integrated with business objectives.
If IT steering committee recommendations are disregarded, it indicates a disconnect between IT governance and business objectives. Effective IT governance ensures IT decisions support and are aligned with the organization's strategic goals.
Why the other options are wrong
- A. Lack of training in IT project management might contribute to disregarding recommendations, but the fundamental issue is the lack of authority or integration of the committee's output.
- B. While a lack of technical expertise could be an issue, the primary problem is the disregard for recommendations, suggesting a higher-level alignment failure.
- C. Insufficient budget could cause project delays, but it doesn't explain why recommendations are 'frequently disregarded' rather than just unfulfilled due to lack of funds.
IT Governance Integration
The process of ensuring that IT strategies and objectives are aligned with the overall business strategies and objectives, and that IT resources are used effectively to achieve organizational goals.
- Ensures IT supports business objectives.
- Involves leadership and organizational structures.
- Critical for value delivery from IT investments.
Memory trick: IT governance is the 'glue' that links tech to business goals.