ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITHard
A CISA is reviewing an organization's IT strategy and notices that it is heavily focused on implementing cutting-edge technologies (e.g., AI, blockchain) without a clear articulation of how these technologies support specific business goals. Which of the following is the MOST significant concern for the CISA?
- ACompetitors may gain an advantage by focusing on proven technologies.
- BThe organization risks investing in technologies that do not deliver business value.
- CThe IT department may struggle to find staff with the necessary skills.
- DThe IT budget will likely be exceeded due to high implementation costs.
Show answer & explanationAnswer & explanation
Correct answer: B. The organization risks investing in technologies that do not deliver business value.
A core principle of IT governance is strategic alignment—ensuring IT investments support business objectives. If IT strategy focuses on technology for technology's sake without a clear link to business goals, the organization risks spending significant resources on initiatives that fail to deliver tangible business value, leading to wasted investment and a lack of return on IT expenditure.
Why the other options are wrong
- A. While a competitive disadvantage is possible, the immediate and direct internal risk is the misallocation of organizational resources and failure to achieve strategic goals.
- C. Staffing challenges are a real concern, but the more fundamental issue is whether the technology itself is beneficial to the business, regardless of who implements it.
- D. Budget overruns are possible, but they are a symptom of a deeper problem: investing without a clear value proposition, which stems from a lack of strategic alignment.
IT-Business Strategic Alignment
The process of ensuring that IT strategies, plans, and investments are directly linked to and support the overall business goals and objectives of an organization.
- Crucial for IT value delivery.
- Prevents IT from becoming an 'island'.
- Requires continuous communication between IT and business.
Memory trick: IT's 'rocket' needs a business 'mission' to avoid just burning fuel.