ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
A CISA is auditing an organization's IT governance framework. The CISA observes that the IT Steering Committee meets quarterly but primarily focuses on reviewing operational IT performance metrics (e.g., uptime, ticket resolution times) rather than strategic IT investments or alignment with business goals. What is the MOST significant implication of this focus?
- ADifficulty in justifying IT budget increases to executive management.
- BSuboptimal allocation of IT resources to strategic initiatives.
- CIncreased risk of shadow IT implementations by business units.
- DDelayed resolution of critical IT operational issues.
Show answer & explanationAnswer & explanation
Correct answer: B. Suboptimal allocation of IT resources to strategic initiatives.
The IT Steering Committee is a key governance body responsible for aligning IT strategy with business objectives and making high-level investment decisions. If it primarily focuses on operational metrics, it neglects its strategic role, leading to IT resources being misdirected or not optimally aligned with the organization's strategic priorities.
Why the other options are wrong
- A. Difficulty in justifying IT budget increases is an outcome; the root cause is the committee's failure to demonstrate strategic value and alignment.
- C. While possible, shadow IT is more often a result of IT being unresponsive or slow, not directly the steering committee's operational focus.
- D. Operational issues are usually handled at a lower management level; the steering committee's role is strategic, not daily operations.
IT Steering Committee Role
A governance body composed of IT and business leaders responsible for guiding IT strategy, prioritizing investments, ensuring IT-business alignment, and overseeing major IT initiatives.
- Focuses on strategic alignment and value.
- Acts as a bridge between IT and business.
- Reviews performance from a strategic perspective.
Memory trick: Steer strategically, not just operationally.