- An organization's IT governance maturity is assessed using a model similar to CMMI. The organization is found to be at a 'repeatable' level. This means:
Answer: Basic IT governance processes exist and are followed consistently, but they may not be formally documented or standardized across the organization.
The 'Repeatable' level (Level 2 in CMMI-based models) indicates processes are established and followed consistently but may lack the formal documentation and standardization of higher maturity levels. Answer B is correct. Optimized (A) is Level 5. Fully defined and measured (C) is Level 3-4. Ad hoc (D) is Level 1.
- A company implements a formal IT governance framework based on COBIT. Which of the following outcomes would best demonstrate that the framework is operating effectively?
Answer: IT investments are consistently aligned with business strategy, IT risks are actively managed within the organization's risk appetite, and key IT governance metrics show improvement over time.
Framework effectiveness is demonstrated by outcomes: strategic alignment, active risk management, and measurable governance improvement - not just adoption or training. Answer D is correct. Framework adoption (A) and training (B) are inputs. Budget reduction (C) is a potential benefit but not a governance effectiveness indicator.
- Which of the following IT governance activities most directly supports the board's oversight of cybersecurity risk?
Answer: Regular board-level reporting on the cybersecurity risk posture, significant incidents, and the organization's key security metrics and improvement plans.
Board oversight of cybersecurity requires regular, meaningful reporting on risk posture, incidents, and improvement - enabling the board to fulfill its governance responsibility. Answer B is correct. Penetration testing (A), SOC implementation (C), and staff training (D) are management/operational activities that support security but are not board governance activities.
- Under the COBIT framework, the distinction between 'governance' and 'management' of enterprise IT is that:
Answer: Governance (Evaluate, Direct, Monitor) is the board's responsibility; management (Plan, Build, Run, Monitor) is the executive and IT leadership's responsibility.
COBIT clearly separates governance (board/governing body responsibilities: evaluate, direct, monitor) from management (executive/IT responsibilities: plan, build, run, monitor). Answer B is correct. IT does not govern and the board does not manage (A). Governance is broader than cybersecurity (C). They are distinct functions (D).
- Which of the following best describes the primary purpose of IT governance?
Answer: To ensure that IT supports and enables organizational objectives, with appropriate oversight, accountability, and risk management.
IT governance establishes the leadership structures, processes, and accountability mechanisms that ensure IT investments and activities align with and support organizational strategy and objectives. Answer B is correct. Day-to-day operations (A), staff training (C), and procurement (D) are management activities, not governance.
- Which of the following represents the most significant indicator of weak IT governance?
Answer: Major IT investments are made without business case analysis or alignment to strategic objectives, and significant IT failures occur without board-level awareness or accountability.
The combination of unstrategic IT investments and unaccountable IT failures are the hallmarks of weak governance - investments are not aligned, and failures are not escalated or addressed at the appropriate level. Answer C is correct. Infrastructure mix (A), occasional overruns (B), and CIO tenure (D) are operational matters, not governance indicators.
- In evaluating IT governance structures, an auditor finds that the organization has no documented IT governance framework but has a very experienced and capable CIO who manages IT effectively. How should the auditor assess this situation?
Answer: Note that reliance on individual competence rather than documented processes and structures is a governance risk - if the CIO leaves, governance may deteriorate significantly.
Governance that relies on individual capability rather than documented structures and processes is fragile - it creates key person dependency risk. If the CIO leaves or is unavailable, there is no institutional framework to maintain governance. Answer C is correct. Individual competence is not a governance structure (A). CIO replacement (B) is not the solution. Organization size does not eliminate governance risk (D).
- Which of the following organizational structures best supports strong IT governance?
Answer: An IT steering committee with cross-functional business and IT leadership provides oversight of IT investments, priorities, and risk.
A cross-functional IT steering committee brings business context to technology decisions, ensuring alignment between IT priorities and business needs - the hallmark of effective IT governance. Answer D is correct. IT-only decision-making (A, B) lacks business alignment. Internal audit provides assurance, not governance (C).
- An organization's IT governance framework lacks a formal IT investment prioritization process. The most likely consequence is:
Answer: IT investments may not align with strategic priorities, resulting in wasted resources and missed opportunities to support key business objectives.
Without a prioritization process, IT resources may be allocated to lower-value projects while high-priority strategic initiatives go unfunded - misaligning IT with business needs. Answer C is correct. Budget sufficiency (A) and regulatory fines (B) are not direct consequences. Missing prioritization processes are not automatically material weaknesses (D).
- Which of the following IT governance responsibilities belongs to the audit committee of the board?
Answer: Overseeing IT risks related to financial reporting, reviewing IT audit findings, and monitoring remediation of significant IT control deficiencies.
The audit committee's IT governance role focuses on financial reporting integrity, internal controls, and audit findings - including IT risks and controls relevant to financial reporting. Answer A is correct. Capital budget approval (B) is an executive or full board function. Vendor management (C) and security policy development (D) are management activities.
- Under Sarbanes-Oxley (SOX), management and the board have specific IT governance obligations related to:
Answer: Maintaining effective internal controls over financial reporting, including IT general controls that support the reliability of financial systems.
SOX requires management and the board to maintain and assess the effectiveness of internal controls over financial reporting - which includes ITGCs over financial systems. Answer C is correct. Staff certifications (A) and maturity frameworks (B) are not SOX requirements. IT incidents are not required to be disclosed in proxy statements (D).
- Which of the following best describes the role of internal audit in IT governance?
Answer: Internal audit provides independent assurance over the effectiveness of IT governance, risk management, and control processes.
Internal audit's IT governance role is assurance - independently evaluating whether governance processes, risk management, and controls are effective and reporting to the audit committee. Answer B is correct. Implementing controls (A) would impair independence. Investment prioritization (C) is a steering committee function. Strategy development (D) is management's role.
- An organization's IT governance assessment finds that IT projects are frequently initiated by individual business units without central oversight, resulting in redundant systems and conflicting priorities. The most appropriate governance improvement is:
Answer: Establishing a centralized IT demand management and portfolio management process that evaluates and prioritizes all IT initiatives through a governance body.
Centralized IT portfolio and demand management provides the governance mechanism to evaluate, prioritize, and approve all IT initiatives - eliminating redundancy and ensuring strategic alignment. Answer A is correct. Prohibiting requests (B) stifles business agility. Internal development requirements (C) are not a governance solution. Further fragmentation (D) worsens the problem.
- A company's IT governance framework includes a formal IT risk management process. The primary purpose of this process is to:
Answer: Identify, assess, prioritize, and manage IT risks in alignment with the organization's risk appetite and strategic objectives.
IT risk management is an ongoing governance process that aligns IT risk decisions with business risk appetite - ensuring IT risks are understood, prioritized, and addressed proportionately. Answer D is correct. Eliminating all risk (A) is not achievable. Not all risks can or should be transferred (B). Risk management is operational, not just for reporting (C).
- Which of the following IT governance documents is most useful for clarifying how IT decisions are made and who has authority for different types of IT decisions?
Answer: An IT decision rights framework (RACI matrix) that defines who is Responsible, Accountable, Consulted, and Informed for each category of IT decision.
An IT RACI or decision rights framework explicitly defines who makes, approves, and is consulted on different IT decisions - a foundational governance document that clarifies accountability and authority. Answer B is correct. The DR plan (A), asset inventory (C), and performance reviews (D) serve operational purposes, not governance decision clarity.
- An organization's IT governance framework assigns accountability for IT risk to the CIO. Which of the following best describes how this accountability should operate in practice?
Answer: The CIO should identify, report, and escalate material IT risks to executive leadership and the board, while coordinating risk response across the organization.
CIO accountability for IT risk means actively managing and escalating risks - not resolving them in isolation or delegating accountability away. The CIO coordinates but involves executive and board stakeholders for material risks. Answer D is correct. Sole CIO resolution (A) misses governance input. Risk scope should be comprehensive (B). Accountability cannot be fully delegated (C).
- An auditor evaluating an organization's IT governance finds that IT-related risks are managed within the IT department but are not included in the enterprise risk management (ERM) framework. The primary concern is:
Answer: IT risks may not be considered alongside other enterprise risks, creating a siloed view that prevents integrated risk management and potentially understates the organization's overall risk profile.
Siloed IT risk management prevents the organization from understanding how IT risks interact with operational, financial, and strategic risks - a critical gap in enterprise governance. Answer A is correct. IT authority (B) is not the issue. Regulatory requirements (C) vary. Internal audit independence (D) is unrelated.
- Which of the following best describes the concept of 'IT value delivery' as an IT governance objective?
Answer: Ensuring IT investments produce measurable business benefits and returns that justify their costs, aligned with strategic priorities.
IT value delivery means IT investments translate into concrete business benefits - revenue growth, cost savings, risk reduction, competitive advantage - justified by their cost. Answer C is correct. Budget adherence (A) is efficiency. Service quantity (B) is operational. Staff compensation (D) is HR management.
- The Chief Information Officer (CIO) reports directly to the CEO and presents quarterly IT strategy updates to the board. This governance structure indicates:
Answer: IT is positioned as a strategic enabler with executive-level visibility, supporting strong IT governance.
CIO reporting to the CEO and regular board engagement with IT strategy are hallmarks of mature IT governance - positioning IT as a strategic partner with appropriate senior oversight. Answer C is correct. Strategic positioning is appropriate, not excessive (A). No cost prioritization inference is warranted (B). Quarterly strategy updates are appropriate governance, not micromanagement (D).
- An organization implements key performance indicators (KPIs) to measure IT governance effectiveness. Which of the following KPIs would be most directly relevant?
Answer: Percentage of IT projects aligned to strategic business objectives, IT-related risk metrics, and ITGC control deficiency trends.
IT governance KPIs measure strategic alignment, risk management, and control effectiveness - the core objectives of governance. Answer A is correct. Staff certifications (B), headcount benchmarks (C), and helpdesk speed (D) are operational metrics that do not directly measure governance effectiveness.
